CVE-2026-66058

MEDIUM

CVE: CVE-2026-66058 - Frappe is a full-stack web application frameworkSign in to save

CVSS

5.3

CVSS v4.0

EPSS

0.2%

Exploit Prediction Score

Published

August 7, 2026

Exploitability

EPSS probability 0.2%

Description

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

Weaknesses

CWE-639CWE-862

Affected Packages

No package data available.

Aliases

CVE-2026-66058

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/frappe/frappe/security/advisories/GHSA-fgx7-fvpx-mw3g