CVE-2026-109600— Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Quick assessment
Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe 框架在 15.118.0 之前版本以及 16.x 版本在 16.31.0 之前版本中，在发送“文档关注”电子邮件通知时，未检查用户账户是否已被禁用。那些先前关注了文档的被禁用用户，在其访问权限本应被撤销后，仍会继续收到关于这些文档活动的电子邮件更新。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109600
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109600
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109600
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109600 (2)
Same Patch Batch · frappe · 2026-10-12 · 86 CVEs total
| CVE-2024-58390 | 8.8 HIGH | Frappe before 15.41.0 Privilege Escalation via Document Action |
| CVE-2026-109608 | 8.8 HIGH | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input |
| CVE-2026-109667 | 8.8 HIGH | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation |
| CVE-2026-109652 | 8.8 HIGH | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields |
| CVE-2025-71432 | 8.1 HIGH | Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover |
| CVE-2026-109640 | 8.1 HIGH | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modificatio |
| CVE-2026-109633 | 8.1 HIGH | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page |
| CVE-2026-109653 | 7.3 HIGH | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover |
| CVE-2026-109612 | 7.3 HIGH | Frappe ERPNext before 15.120.0 Stored XSS via Report View |
| CVE-2026-109673 | 7.3 HIGH | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names |
| CVE-2026-109604 | 7.3 HIGH | ERPNext before 15.112.0 Stored XSS via Tool View Record Names |
| CVE-2026-109671 | 7.3 HIGH | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages |
| CVE-2026-109616 | 7.1 HIGH | Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification |
| CVE-2026-109617 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints |
| CVE-2026-109613 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modificati |
| CVE-2026-109627 | 6.5 MEDIUM | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109631 | 6.5 MEDIUM | Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation |
| CVE-2026-109628 | 6.5 MEDIUM | Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization |
| CVE-2026-109624 | 6.5 MEDIUM | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data |
| CVE-2026-109659 | 6.5 MEDIUM | Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data |
Showing top 20 of 86 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: frappe
-
CVE-2026-109603
Frappe Framework before 16.17.0 Authenticated SSRF and LFI v -
CVE-2026-109602
Frappe before v16.31.0 Stored XSS via Dashboard Chart Filter -
CVE-2026-109601
Frappe Framework before v16.30.0 Arbitrary File Read via Out -
CVE-2026-109598
Frappe before 16.33.0 Broken Authorization via send_sms Endp -
CVE-2026-109599
Frappe before 15.113.3 Missing Authorization Allows Unauthor
Same vendor: frappe
-
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes -
CVE-2026-109673
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record -
CVE-2026-109670
Frappe ERPNext before 15.110.0 Stored XSS via Item Record Na
Same weakness: CWE-862
-
CVE-2026-109699
WordPress User Registration plugin <= 5.2.8 - Broken Access -
CVE-2026-106598
WordPress User Registration plugin <= 5.2.8 - Sensitive Data -
CVE-2026-108174
WordPress FOX plugin <= 1.5.4 - Broken Access Control vulner -
CVE-2026-106597
WordPress User Registration plugin <= 5.2.8 - Broken Access -
CVE-2026-109696
WordPress FluentBoards plugin <= 2.1.0 - Broken Access Contr
V. Comments for CVE-2026-109600
No comments yet