The flaw in Frappe Framework fails to verify a user's disabled status before sending Document Follow email notifications. As a result, a disabled user who had previously followed documents continues to receive updates about activity on those documents even after access should have been revoked. This leads to unintended disclosure of document activity and potentially sensitive information to a user who should no longer receive notifications, which can be leveraged for social engineering or privacy violations.

Vendors and products affected are the Frappe Framework, identified as frappe:frappe. The vulnerability applies to all releases before 15.118.0 and to 16.x releases earlier than 16.31.0. Users running any of these versions should verify their deployment against the affected intervals.

The CVSS score of 6.9 indicates medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this weakness by simply observing that a disabled user continues to receive email updates; they do not need additional privileges. The likely attack vector is through the email notification system itself, making the vulnerability actionable in environments where users receive frequent updates. Given the moderate CVSS score and lack of exploitation evidence, the risk is significant for organizations that rely on strict access controls but moderate if mitigated promptly.