Is CVE-2026-109600 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109600?

CVE-2026-109600 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-109600

Description

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.