Executive brief
Frappe is a popular web application framework used to build business software. The framework's document liking and note-viewing features fail to check whether a user has permission to read a document before allowing them to interact with it. An authenticated user can exploit this to discover which documents exist in the system and modify metadata about them, potentially revealing sensitive information about what documents are present.
Technical details
The vulnerability is an authorization bypass affecting the whitelisted toggle_like endpoint in frappe/desk/like.py and mark_as_seen endpoint in frappe/desk/doctype/note/note.py. These endpoints fail to enforce read permission checks before modifying _liked_by metadata or Note seen state. An authenticated attacker can call these endpoints on documents or notes they cannot read, disclosing resource existence and modifying associated metadata. The attack requires authentication but no other preconditions. A fix has been implemented in commit 91155d1 adding permission checks; however, no official release containing the fix was available at the time of advisory publication.
Affected products
- Frappe Frappe 16.31.0 and earlier
Timeline
- 2026-08-20: disclosed