Description (CNA)
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| frappe / frappe | affected 0 before 15.118.0; affected 16.0.0-beta.1 before 16.31.0; unaffected 15.118.0; unaffected 16.31.0 |
CWE
CWE-862
References
- https://github.com/frappe/frappe/security/advisories/GHSA-55m4-gj6h-q6rc
- https://www.vulncheck.com/advisories/frappe-before-16.31.0-improper-access-control-in-document-follow-notifications
ADP enrichment
No English description supplied.
No references supplied.