Frappe Framework CVE-2026-66059

Exploitation requires an authenticated Frappe user account (PR:L - unauthenticated access is not possible). The vulnerability specifically triggers via the document follow / version timeline feature: the affected user must be following a document that has had field changes recorded, and those fields must have permlevel restrictions configured. If the target deployment does not use Frappe's field-level (permlevel) permission system to restrict fields, there is no exploitable information disclosure. Child table field changes and top-level DocType field changes are both affected prior to the fix. Limiting factors are: valid authenticated session required, the document follow feature must be active and the user must be following the specific document, and the targeted DocType must have permlevel-restricted fields containing sensitive data.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N yields a score of 5.3, consistent with a network-accessible, low-complexity, authenticated-only confidentiality exposure with no integrity or availability impact. The PR:L metric correctly reflects the authentication requirement - unauthenticated exploitation is not possible. No EPSS data was provided in source intelligence, so probability of exploitation in the wild cannot be quantified. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified. Real-world risk is elevated in Frappe/ERPNext deployments that actively use field-level permissions to protect sensitive data - for example, salary fields in HRMS, cost fields in manufacturing, or private notes in CRM - since the bypass defeats a core access-control feature. In deployments that do not configure permlevel restrictions, there is effectively no exposure. The risk is therefore highly context-dependent: high-sensitivity deployments that rely on permlevel controls should treat this as a priority; others face minimal impact.

An authenticated Frappe user with read access to a Sales Order (or any DocType with permlevel-restricted fields such as cost price or internal margin) enables document follow for that record. When any user updates a restricted field, the change appears in the document follow timeline for all followers, regardless of their permlevel permissions. No exploit code has been identified; the attack requires only standard application navigation by a legitimately authenticated user.