CVE-2026-66058
Received Received - Intake

Authentication Bypass in Frappe Framework

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-66058
EUVD
EUVD-2026-54560

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe frappe to 16.20.0|end_excluding=15.112.0 (exc)
frappe frappe to 16.23.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66058 is a vulnerability in the Frappe Framework where an authenticated user can gain unrestricted access to the Document Follow API, specifically the update_follow function. This affects versions before 16.20.0 and 15.112.0.

Impact Analysis

An attacker with access could manipulate document follow settings without proper authorization, potentially leading to unauthorized notifications or data exposure.

Mitigation Strategies

Update Frappe Framework to version 16.23.0 or 15.112.0 or later to patch the vulnerability. No workarounds are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart