CVE-2026-66058

Received Received - Intake

Authentication Bypass in Frappe Framework

Publication date: 2026-08-07

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-10

Generated

2026-08-28

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-66058

EUVD

EUVD-2026-54560

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	to 16.20.0\|end_excluding=15.112.0 (exc)
frappe	frappe	to 16.23.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-66058 is a vulnerability in the Frappe Framework where an authenticated user can gain unrestricted access to the Document Follow API, specifically the update_follow function. This affects versions before 16.20.0 and 15.112.0.

Detection Guidance

To detect this vulnerability, check the Frappe Framework version installed on your system. If it is below 16.20.0 or 15.112.0, the system is vulnerable. Run commands like 'bench version' or check the package.json file for the installed version.

Impact Analysis

An attacker with access could manipulate document follow settings without proper authorization, potentially leading to unauthorized notifications or data exposure.

Compliance Impact

The vulnerability allows unauthorized access to document follow functionality, which could lead to unauthorized tracking or monitoring of user activities. This may violate data protection principles under GDPR and HIPAA if it involves processing personal or health data without proper authorization.

Mitigation Strategies

Update Frappe Framework to version 16.23.0 or 15.112.0 or later to patch the vulnerability. No workarounds are available.

Hi! I’m here to help you understand CVE-2026-66058. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70