Description
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | frappe | < 15.118.0, 16.0.0-beta.1 – < 16.31.0 | 15.118.0 |
References
- GitHub Security Advisory (GHSA-55m4-gj6h-q6rc) vendor-advisory
- VulnCheck Advisory: Frappe before 16.31.0 Improper Access Control in Document Follow Notifications third-party-advisory