CVE-2026-66058General

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

0.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-639CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-30); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-30: 1Mentions · 2026-08-11: 107-3008-11
Signal classification2 categories
General
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-301
General1
2026-08-111
Disclosure1
Full discourse2 posts
  • Robin Roy@_RobinRoy
    Disclosure

    wrote a security blog about a chain of @frappetech framework vulnerabilities I discovered - CVE-2026-66000, CVE-2026-66058, CVE-2026-66059 https://robinroy.xyz/blog/frappe-document-follow-vulnerability/

    Post summary

    The blog post announces a chain of three new CVEs in the Frappetech framework, but it offers no POCs, exploit code, active usage reports, patch info, or technical details.

    310141371
    426 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-66058 Kimu https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-66058

    Post summary

    The entry merely lists CVE‑2026‑66058 for Kimu without any further technical, exploit, patch, or contextual details.

    00000113
    4.1K followersView on X

Explore more