CVE-2026-53569

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.31.1

Description An authenticated user can interact with documents or notes they do not have permission to read. This occurs because the whitelisted endpoints 'toggle like' and 'mark as seen' in frappe/desk/like.py and frappe/desk/doctype/note/note.py fail to enforce read permissions before modifying the liked by metadata or the seen state of a Note. This flaw allows for the disclosure of resource existence and the unauthorized modification of resource-associated metadata.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.