A flaw in the Frappe framework allows any authenticated user to call the Document Follow API (update_follow) without proper authorization checks. The vulnerability enables users to alter follow state of documents they should not manage, potentially leading to undesired data modification or exposure of user activity. It is rooted in missing access controls, as indicated by CWE‑639 and CWE‑862.

The flaw affects instances of the Frappe web application framework running versions prior to 16.20.0 and 15.112.0. Vendors or customers using these legacy releases should verify their installed version and plan an upgrade to the patched releases.

The CVSS score of 5.3 classifies the issue as moderate severity. Because the exploit requires only authentication and no additional privileges, any user with a valid account can trigger the API. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation at this time. Nonetheless, the ability to perform unauthorized actions presents a tangible risk to data integrity.