https://robinroy.xyz/blog/ Recent content in Blog on Robin Roy Hugo en-us Sun, 02 Aug 2026 06:42:18 +0530 https://robinroy.xyz/blog/frappe-document-follow-vulnerability/ Sun, 02 Aug 2026 06:42:18 +0530 https://robinroy.xyz/blog/frappe-document-follow-vulnerability/ <p><a href="https://github.com/frappe/frappe/" target="_blank" rel="noopener noreferrer">Frappe</a> is an open-source framework used to build software like <a href="https://github.com/frappe/erpnext/" target="_blank" rel="noopener noreferrer">ERPNext</a>, a widely deployed open-source ERP. My job is mostly working with apps built on this framework. During one session in May I noticed some peculiarities with how frappe&rsquo;s document follow feature is implemented. Curious, I dug deep to find a chain of three authorization failures - one at the object level, one at the field level, and one in the lifetime of the grant itself - that allowed an attacker to access data they aren&rsquo;t authorized to.</p>