Frappe Framework CVE-2026-66000

Three specific conditions must simultaneously hold: (1) the Document Follow feature must be enabled in the Frappe system configuration - it is not universally active by default across all deployments; (2) the targeting user must have previously held at least read-level access to the specific document and must have subscribed to its Document Follow notifications prior to access revocation; and (3) an administrator must have subsequently revoked or reduced that user's document permissions without the revocation propagating to pre-existing Document Follow subscription records. The vulnerability does not affect documents the user never had access to. Exploitation is bounded to the content of notification email digests - it does not grant interactive system access, API access, or read access beyond what was present in scheduled notifications. The CVSS 4.0 PR:L metric confirms prior authentication is required; unauthenticated attackers cannot exploit this flaw.

The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N yields a score of 2.3, and the metrics are internally consistent with the description. AT:P (attack requirements present) captures the critical limiting condition: exploitation only occurs when a user's access has already been revoked and a stale subscription persists, making this a transient, conditional window rather than a persistent open attack surface. PR:L confirms the attacker must previously have held authenticated access to the targeted document. Confidentiality impact is scoped to VC:L, reflecting exposure of document field data surfaced in email notification bodies, not arbitrary system data or credential material. No CISA KEV listing exists, no public exploit code has been identified, and no EPSS score was provided in the input data. Despite the very low CVSS score, organizations operating in regulated environments - GDPR, HIPAA, SOC 2 - should treat this as an elevated data-governance concern because even limited unauthorized disclosure of business record content can carry compliance consequences. For unregulated deployments the residual risk after standard access review processes is negligible.

An employee who previously held read access to a Frappe document containing sensitive business data subscribes to Document Follow notifications before an administrator revokes their access during an offboarding or role-change event. Frappe's periodic notification scheduler subsequently continues to dispatch email digests containing document field changes to the now-unauthorized user. No exploit tooling or special knowledge is required; the disclosure occurs passively through the normal scheduled notification job.