CVE-2026-66058 Overview
CVE-2026-66058 is an authorization flaw in Frappe, a full-stack web application framework used to build business applications including ERPNext. The vulnerability affects the update_follow Document Follow API, which lacks proper access restrictions for authenticated users. Any authenticated user can invoke the endpoint without appropriate authorization checks, resulting in low-impact confidentiality and integrity exposure on document follow state. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and is fixed in Frappe versions 16.20.0 and 15.112.0.
Critical Impact
Authenticated users can invoke the Document Follow API without proper authorization, allowing manipulation of follow relationships across documents they should not access.
Affected Products
- Frappe framework versions prior to 15.112.0 (15.x branch)
- Frappe framework versions prior to 16.20.0 (16.x branch)
- Downstream applications built on affected Frappe versions, including ERPNext deployments
Discovery Timeline
- 2026-08-07 - CVE-2026-66058 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-66058
Vulnerability Analysis
Frappe's Document Follow feature allows users to subscribe to updates on individual documents. Subscription state is managed through the update_follow API endpoint. The vulnerability stems from missing authorization enforcement on this endpoint. Any authenticated user can call the API, regardless of whether they have permission to access the target document.
The flaw is categorized as [CWE-639], where authorization decisions rely on user-supplied identifiers without verifying the requesting user's rights against the target resource. Exploitation requires only low-privilege authenticated access and no user interaction. Impact is limited to the follow state of documents rather than their underlying content.
Root Cause
The update_follow handler does not validate whether the authenticated caller has read or modify permission for the target document referenced in the request. Frappe's standard permission framework enforces role and document-level checks, but this endpoint bypassed that layer.
Attack Vector
An attacker with valid credentials sends an authenticated HTTP request to the update_follow API method, supplying the doctype and name of a target document. The server processes the request without confirming the caller's permission on that document. Because the attack is network-based and requires no elevated privileges, it can be scripted against any exposed Frappe instance.
Refer to the Frappe GitHub Security Advisory GHSA-fgx7-fvpx-mw3g for the maintainer's technical description.
Detection Methods for CVE-2026-66058
Indicators of Compromise
- HTTP requests to /api/method/frappe.desk.form.utils.update_follow or equivalent RPC calls from user accounts that do not normally interact with the referenced doctypes.
- Unexpected entries in the Document Follow table referencing documents outside the user's typical scope.
- Spikes in update_follow API calls originating from a single session or automated client.
Detection Strategies
- Review Frappe application logs for calls to the update_follow method and correlate the calling user with permission on the target doctype and document.
- Alert on authenticated API calls that target document names the calling user has never opened through the standard UI workflow.
- Compare version strings of deployed Frappe instances against fixed versions 15.112.0 and 16.20.0 to identify vulnerable hosts.
Monitoring Recommendations
- Enable verbose API request logging on Frappe web workers and forward logs to a centralized store for retention and analysis.
- Track per-user API call volume to the Document Follow endpoints and baseline normal behavior.
- Monitor administrator and privileged accounts for unusual follow-state changes that could indicate reconnaissance of sensitive documents.
How to Mitigate CVE-2026-66058
Immediate Actions Required
- Upgrade Frappe to version 15.112.0 on the 15.x branch or 16.20.0 on the 16.x branch.
- Audit existing Document Follow records for entries created by users without legitimate access to the target documents and remove unauthorized entries.
- Rotate API keys and session tokens for accounts that may have been used to exercise the vulnerable endpoint.
Patch Information
Frappe maintainers released fixed builds in versions 16.20.0 and 15.112.0. The patch adds permission checks so that update_follow verifies the calling user has access to the referenced document before modifying follow state. See the GitHub Security Advisory GHSA-fgx7-fvpx-mw3g for release details and commit references.
Workarounds
- Restrict network access to the Frappe API surface using a reverse proxy or web application firewall until patched versions are deployed.
- Disable or hide the Document Follow feature in the site configuration if it is not required by business workflows.
- Reduce the population of low-privilege authenticated accounts and enforce short session lifetimes to limit exposure.
# Upgrade Frappe using the bench CLI
bench switch-to-branch version-15 frappe
bench update --patch
bench --site all migrate
# Verify installed version meets or exceeds the fixed release
bench version | grep frappe
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
