CVE-2026-109600 in Frappe
Summary
by MITRE • 10/13/2026
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The Frappe Framework, a low-code web framework used for building business applications such as ERPNext and custom enterprise software, contains a logical flaw in its notification system that allows disabled user accounts to continue receiving automated email communications. This vulnerability exists because the application logic responsible for dispatching Document Follow notifications fails to perform an active status check on the recipient's account before initiating the send operation. In typical web application architectures, disabling a user account is intended to revoke all forms of access and interaction with the system, including passive activities like receiving automated updates. However, in versions prior to 15.118.0 for version 15.x and prior to 16.31.0 for version 16.x, the code path that iterates through users following a specific document does not validate whether those users are currently active or disabled within the database before queuing or sending emails.
From a technical perspective, this issue represents a failure in access control validation during event-driven processes. When a user follows a document, their identifier is stored to trigger notifications upon subsequent changes such as edits, comments, or status updates. The system retrieves these followers and attempts to send them an email whenever the document state changes. The critical oversight lies in the fact that while the framework correctly prevents disabled users from logging in or performing active transactions, it neglects to filter out inactive accounts during the passive notification dispatch phase. This creates a discrepancy between the intended security policy of account revocation and the actual operational behavior of the system, allowing data flow to persist for terminated or suspended personnel.
The operational impact of this vulnerability is primarily related to information disclosure and potential privacy violations. Disabled users may continue to receive sensitive business intelligence contained within document updates, such as financial records, customer details, or internal strategic plans. This can lead to unauthorized access to confidential information even after the user has been formally removed from active service. Furthermore, for organizations with strict compliance requirements regarding data retention and access logging, this behavior complicates audit trails by generating activity logs for accounts that should have no operational footprint. It also increases the risk of phishing or social engineering attacks if an attacker gains control over a disabled account's email inbox, as they would still receive legitimate-looking system notifications that could be leveraged to maintain trust or extract further credentials.
This flaw aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials in the broader context of identity management failures, specifically relating to the failure to enforce access restrictions during automated processes. In terms of MITRE ATT&CK mapping, this behavior can be associated with T1078 Valid Accounts, as it allows a disabled account to maintain an active channel for information receipt despite being revoked from other interactive functions. It also touches upon T1534 Internal Spearphishing if the notifications are used by malicious actors who have compromised or retained access to the email accounts of former employees.
To mitigate this vulnerability, organizations running affected versions of Frappe must upgrade immediately to version 15.118.0 or later for the v15 branch, and version 16.31.0 or later for the v16 branch. These releases include patches that enforce a status check on user accounts before sending follow notifications. For environments where immediate patching is not feasible due to dependency constraints, administrators should implement compensating controls such as monitoring email logs for unusual activity from disabled users and manually reviewing follower lists periodically to ensure no inactive accounts remain subscribed to sensitive documents. Additionally, enforcing strict identity lifecycle management policies that automatically purge or archive data associated with terminated employees can help reduce the blast radius of this logical flaw until a permanent fix is deployed.