CyberRota Analysis
AI-GeneratedFrappe's Document Follow notification feature is vulnerable as it fails to update recipient permissions, allowing users with revoked or reduced access to continue receiving sensitive document data via email. This could lead to unauthorized information exposure. Organizations using affected versions should prioritize upgrading to versions 16.23.0 or 15.112.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.