CVE-2026-109600

Deferred Deferred - Pending Action

Frappe Framework Email Notification Flaw for Disabled Users

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109600

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Frappe Framework versions before 15.118.0 and 16.x before 16.31.0 have a flaw where disabled user accounts still receive Document Follow email notifications for documents they previously followed. The system fails to check if a user account is disabled before sending these notifications.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive information via email notifications even after a user's access should have been revoked. It may lead to data leaks or compliance violations if disabled users receive updates they are no longer authorized to access.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by allowing unauthorized individuals to receive sensitive information via email after their access should have been terminated. It may result in non-compliance with access control and data protection requirements.

Mitigation Strategies

Update Frappe Framework to version 15.118.0 or later if using 15.x, or to 16.31.0 or later if using 16.x. Disable and remove email notifications for disabled user accounts to prevent them from receiving updates.

Hi! I’m here to help you understand CVE-2026-109600. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70