CVE-2026-53569: Frappe: Missing authorization in toggle_like and mark_as_seen
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata. No released fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the Frappe application. They can target documents or Notes that they do not have permission to read.
What can an attacker do through the affected endpoints?
They can toggle the like state in a document’s _liked_by metadata or mark a Note as seen without read permission. This can disclose whether a targeted resource exists and alter metadata associated with it.
Are there fixed releases available?
No released fixed version was available as of the review. The issue affects version 16.31.0 and earlier.