Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-30 | 1 | General1 |
| 2026-08-11 | 1 | Disclosure1 |
wrote a security blog about a chain of @frappetech framework vulnerabilities I discovered - CVE-2026-66000, CVE-2026-66058, CVE-2026-66059 https://robinroy.xyz/blog/frappe-document-follow-vulnerability/
Post summary
The author announced a chain of three Frappetech framework vulnerabilities (CVE-2026-66000, CVE-2026-66058, CVE-2026-66059) in a blog post.
CVE-2026-66059 Kimu https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-66059 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet simply references CVE‑2026‑66059 with a link to vulnerable details, offering no further information or actionable content.