CVE-2026-66058

Vulnerability Description

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

Related Weaknesses (CWE)

CWE-862 CWE-639

References

https://github.com/frappe/frappe/security/advisories/GHSA-fgx7-fvpx-mw3g

FAQ

What is CVE-2026-66058?

CVE-2026-66058 is a documented vulnerability. Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed...

How severe is CVE-2026-66058?

CVSS scoring is not yet available for CVE-2026-66058. Check NVD for updates.

Is there a patch for CVE-2026-66058?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.