CVE-2026-53569

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata. No released fixed version is available as of this review.

• CWE-862

• https://github.com/frappe/frappe/commit/91155d12deba4426cf33196805da77bc78c5cde1
• https://github.com/frappe/frappe/commit/aeb93abe6b217ea0ae27253ef105ad6d0803613e
• https://github.com/frappe/frappe/pull/39760
• https://github.com/frappe/frappe/security/advisories/GHSA-rx6h-4p83-m76x

Published

Aug 20, 2026

Last Modified

Sep 10, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53557SQLBot is an intelligent Text-to-SQL system based on large l…7.7
• CVE-2026-5356The LatePoint – Calendar Booking Plugin for Appointments and…7.5
• CVE-2026-53561An improper authentication vulnerability in HiveServer2 SAML…7.4
• CVE-2026-53565Improper Privilege Management vulnerability in Citrix Secure…8.5
• CVE-2026-53566Out-of-bounds read vulnerability in Citrix Citrix Secure Acc…6.8
• CVE-2026-53568Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-5357The Download Manager plugin for WordPress is vulnerable to S…6.4
• CVE-2026-53571Vite is a frontend tooling framework for JavaScript. Prior t…7.5
• CVE-2026-53572KEDA is a Kubernetes-based Event Driven Autoscaling componen…5.9
• CVE-2026-53573GeoNetwork is a catalog application to manage spatially refe…4.8
• CVE-2026-53576Kestra is an open-source, event-driven orchestration platfor…10
• CVE-2026-53577Kestra is an open-source, event-driven orchestration platfor…6.5