EUVD-2026-54560Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable IDOR requiring authenticated session (PR:L); limited confidentiality and integrity impact on document follow state only, no availability or scope change.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.
AnalysisAI
Unrestricted access to the Document Follow API (update_follow) in Frappe framework allows any authenticated user to follow or unfollow arbitrary documents without authorization checks, constituting an Insecure Direct Object Reference (IDOR) flaw classified under CWE-639. Frappe versions prior to 16.20.0 (v16 branch) and 15.112.0 (v15 branch) are affected, enabling authenticated attackers to subscribe to change notifications for documents outside their authorization scope. No public exploit code exists and no active exploitation has been identified at time of analysis.
Technical ContextAI
Frappe is a Python/JavaScript full-stack web application framework primarily underpinning business applications such as ERPNext. Its Document Follow feature lets users subscribe to change notifications for specific documents by doctype and docname. The update_follow API endpoint accepts user-controlled document identifiers but, per CWE-639 (Authorization Bypass Through User-Controlled Key), fails to verify whether the requesting user holds the necessary permissions to interact with the referenced document. This is a classic IDOR pattern: the server trusts the client-supplied key without cross-checking it against the user's access control list. No CPE strings were provided in the available intelligence, but affected versions are confirmed as all Frappe releases on both the v15 and v16 branches prior to the fixed versions.
RemediationAI
Upgrade Frappe to version 16.20.0 or later on the v16 branch, or to version 15.112.0 or later on the v15 branch; these releases contain the authorization fix for the update_follow endpoint, as confirmed by the GitHub Security Advisory at https://github.com/frappe/frappe/security/advisories/GHSA-fgx7-fvpx-mw3g. If immediate patching is not feasible, operators may restrict or disable the Document Follow feature at the application or web server layer - note this will remove document subscription notifications for all users as a trade-off. Limiting authenticated user accounts to the minimum necessary set also reduces the pool of potential exploiters, though this does not address the root authorization flaw.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today