# CVE-2026-109600: Frappe Framework missing authorization in Document Follow email notifications

Source: https://junglewise.ai/threats/cve-2026-109600-frappe-framework-before-15-118-0-and-16-x-before-16-31-0-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109600 · Severity: medium · CVSS 5.3 · Published 2026-10-12

Frappe Framework, a web development framework used to build business applications, continues sending document activity notifications to disabled user accounts. An attacker or disgruntled employee with a disabled account can maintain visibility into sensitive document changes they should no longer access, potentially exposing confidential business information.

Technologies: [Frappe Framework](https://junglewise.ai/threats/technologies/frappe). Vendors: [Frappe](https://junglewise.ai/threats/vendors/frappe).

## Quick answers

**Is CVE-2026-109600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109600 being exploited in the wild.

**How severe is CVE-2026-109600?** Medium severity, with a CVSS score of 5.3, published 12 October 2026.

**Which products and versions are affected?** Frappe Framework before 15.118.0, 16.x before 16.31.0.

**Is there a fix for CVE-2026-109600?** Yes: fixed in Frappe Framework 15.118.0, 16.31.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109600 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-109600?** Check whether you run Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Frappe Framework 15.118.0, 16.31.0

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the Document Follow feature's email notification logic. When a user account is disabled, the framework fails to verify the user's active status before dispatching follow notifications, allowing disabled accounts to continue receiving emails about followed documents. This requires no authentication or user interaction—notifications are sent automatically based on pre-existing follow subscriptions.

## Affected products

- Frappe Framework before 15.118.0, 16.x before 16.31.0

## Timeline

- 2026-09-11: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/frappe/frappe/security/advisories/GHSA-55m4-gj6h-q6rc](https://github.com/frappe/frappe/security/advisories/GHSA-55m4-gj6h-q6rc)
- [https://www.vulncheck.com/advisories/frappe-before-16.31.0-improper-access-control-in-document-follow-notifications](https://www.vulncheck.com/advisories/frappe-before-16.31.0-improper-access-control-in-document-follow-notifications)

## Related threats

- [Frappe Framework blind SQL injection in get_events method](https://junglewise.ai/threats/cve-2026-114664-frappe-framework-before-16-33-0-contains-a-blind-sql-injection)
- [Frappe Framework arbitrary file read in outgoing email HTML](https://junglewise.ai/threats/cve-2026-109601-frappe-framework-before-15-117-0-and-16-x-before-16-30-0)
- [Frappe Framework missing authorization in send_sms API](https://junglewise.ai/threats/cve-2026-109598-frappe-framework-before-15-120-0-and-16-x-before-16-33-0)