Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2025-59421

Press vulnerable to email flooding to users due to lack of validation and rate limits

Description

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood the inbox of a user by repeatedly sending invites (duplicate). The issue is fixed in commit 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

frappe press

  • < 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615affected

References