You probably think your ERP system is locked down. You’ve got authentication, role-based permissions, maybe even 2FA. You feel safe. You shouldn’t.
There’s a button inside ERPNext — the Frappe-based ERP used by thousands of organizations worldwide — that looks completely harmless. It says “Follow.” You click it, you get notifications when a document changes. Convenient, right? That same button is also a pipeline that can quietly leak data to people who were never supposed to see it.
The most dangerous vulnerabilities aren’t buried in complex business logic. They’re sitting in the convenience layer, wearing a friendly label.
Here’s what happened. A security researcher discovered a chain of vulnerabilities in the Frappe framework’s Document Follow feature. The core issue: the system trusted feature-level visibility without enforcing object-level authorization. In plain English? It checked whether you were allowed to use the Follow feature, but never checked whether you were allowed to see the document you were following.
That’s a catastrophic gap. It means a user who should only see their own department’s documents could follow — and thereby access — documents they have zero authorization to view. No exploit chain requiring elite skills. No zero-day payload. Just a button that does exactly what it says, while quietly violating every access control assumption your organization made.
Think about what lives inside your ERP. Salary structures. Vendor pricing. Customer contracts. Internal memos about restructuring. Now imagine someone in a completely different department clicking “Follow” on a document they were never granted access to — and the system happily obliging.
Access control isn’t a feature you bolt on. It’s a default-deny posture you enforce at every single data interaction point — or it’s theater.
The deeper problem here isn’t even this specific bug. It’s the mindset that created it. The Frappe framework, like many collaboration-first platforms, was built to increase openness and visibility. That’s the selling point. “See more, share more, collaborate more.” But openness and authorization are in direct tension. Every feature that increases visibility is also a potential exfiltration channel if authorization isn’t enforced at the framework level — not at the feature level, not at the UI level, at the framework level where data actually moves.
Most security attention goes to authentication. Can you prove who you are? Great, come on in. But authorization — what you’re allowed to do once you’re inside — gets treated as an afterthought. It’s the unglamorous cousin. Nobody writes blog posts about role-based access control. But authorization failures are how real data leaks happen. Not through sophisticated breaches. Through mundane convenience features that nobody audited.
Authentication is the bouncer at the door. Authorization is the lock on every room inside. Most organizations have a great bouncer and no locks.
If your organization runs ERPNext or any Frappe-based application, this is your wake-up call. Don’t assume framework defaults are safe. Audit your Follow permissions. Check what documents can actually be followed and by whom. Test it yourself — try following a document you shouldn’t have access to and see what happens. The answer might keep you up at night.
The researcher who found this wasn’t looking for it in some advanced persistent threat simulation. They were exploring how the framework handled document visibility. That’s the thing about authorization bugs — they’re not hiding from you. They’re hiding in the open, disguised as features people use every day without thinking.
Every convenience feature is a security question you haven’t answered yet. The Follow button was just the one that got caught.
This vulnerability has been disclosed and addressed. But the pattern it reveals is everywhere. Frameworks prioritize features because features sell. Security gets patched in later, if it gets patched in at all. The result is an entire generation of collaboration tools built on the assumption that visibility is safe by default.
It isn’t. It never was. And the next feature you enable without auditing its authorization model might be the one that leaks your most sensitive data to the last person who should see it.
FAQ
Q: Isn't this just a bug that's been patched? Why should I still care?
A: The specific bug is fixed, but the pattern is systemic. Frappe and frameworks like it prioritize feature-level visibility over object-level authorization. If you're running any version of ERPNext, you need to audit what was accessible during the vulnerable window — and verify your current Follow permissions are actually scoped correctly.
Q: What does this mean practically for my organization?
A: Go try to follow a document you shouldn't have access to. If the system lets you, you have the same class of vulnerability. More broadly: stop trusting that framework defaults enforce authorization. They usually enforce UI visibility, which is not the same thing as data-level access control.
Q: Isn't authentication the real security boundary? If someone's inside, they're trusted?
A: That's exactly the mindset that creates these leaks. Authentication proves identity. Authorization defines what that identity can touch. Most organizations over-invest in the front door and under-invest in the internal locks. A authenticated user with the wrong authorizations is a bigger threat than an unauthenticated attacker hitting a well-defended perimeter.