Frappe Framework EUVD-2026-98163

Requires that the affected user previously used Frappe's Document Follow feature to follow one or more documents while their account was active, and that the account is subsequently disabled (not deleted) in a version before 15.118.0 or 16.31.0. The only data exposed is activity on documents the user already followed - no new document access is granted. Exploitation is limited to former/disabled users with a still-valid email address that continues to receive mail; it does not enable arbitrary access by unrelated external attackers despite the AV:N/PR:N framing.

This is a missing-authorization information-disclosure flaw (CWE-862) rather than a code-execution or takeover bug. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with only VC:L and VI/VA:N yields a 6.9 (Medium) score and models it as network-reachable, low-complexity, and unprivileged - but that framing is misleading for the actual mechanism: the 'attacker' is a previously-legitimate user whose account was disabled, and exploitation is passive (emails simply keep arriving), not an active network attack. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world risk is modest and privacy/offboarding-oriented: it leaks ongoing document-activity metadata to former users whose access should have been revoked. Note the discrepancy - CVSS PR:N implies unauthenticated, yet the flaw inherently requires a pre-existing (now-disabled) account that previously used the Document Follow feature, so treat the PR:N characterization with caution. This is a legitimate hygiene/compliance issue (offboarding leakage) but not a mass-exploitation priority.

An employee is offboarded and their Frappe account is disabled, but because they had previously followed sensitive records (e.g. deals, HR, or finance documents), they continue receiving email notifications about activity on those documents, leaking ongoing internal business information after their access was supposed to end. No public exploit code exists; exploitation is passive and requires no active steps by the former user. Attack vector is network (email delivery) with low complexity.