Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
wrote a security blog about a chain of @frappetech framework vulnerabilities I discovered - CVE-2026-66000, CVE-2026-66058, CVE-2026-66059 https://robinroy.xyz/blog/frappe-document-follow-vulnerability/
Post summary
The author states discovery of three CVEs and links to a blog post, but provides no detail about exploitation, patches, or technical aspects in the provided text.
CVE-2026-66000 Kimu https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-66000
Post summary
The only information provided is the CVE identifier, a reference to "Kimu", and a link to a vulnerability page; no further details or action items are included.