Security vulnerabilities I’ve found and reported.

• Medium GHSA-55m4-gj6h-q6rc · CVSS 5.3 · Writeup
  Disabled users continue to receive Document Follow email notifications
• High CVE-2026-66003 · CVSS 7.1
  Access control bypass via REST API
  Access control bypass via REST API on Linked DocTypes.
• Medium CVE-2026-66059 · CVSS 5.3 · Writeup
  Field-level permission bypass via Document Follow
  Field-level permission bypass exposes restricted DocType fields.
• Medium CVE-2026-66058 · CVSS 5.3 · Writeup
  Unrestricted access to a Document Follow API
  Unrestricted access to a Document Follow API (update_follow) for an authenticated user is possible.
• Medium CVE-2026-66000 · CVSS 2.3 · Writeup
  Stale authorization in Document Follow allows revoked users to continue receiving document data
  If a user follows a doc and has their access revoked or reduced, they still continue to receive emails for that document.