Skip to content
OpenAdvisories
Low · 2.7 CVE-2025-59421 EUVD-2025-30203

Press vulnerable to email flooding to users due to lack of validation and rate limits

Published Sep 18, 2025 · Updated Sep 19, 2025 · Assigned by GitHub_M

Description

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood the inbox of a user by repeatedly sending invites (duplicate). The issue is fixed in commit 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615.

Affected products

VendorProductAffectedFixed
frappe press < 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615 —

References