CVE-2025-59421: Press vulnerable to email flooding to users due to lack of validation and rate limits

Severity: low (CVSS 2.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-18 · updated 2026-06-17
Weakness: CWE-770

Description

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood the inbox of a user by repeatedly sending invites (duplicate). The issue is fixed in commit 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615.

Affected products

frappe press: before 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615

References

https://github.com/frappe/press/commit/83c3fc7676c5dbbe1fd5092d21d95a10c7b48615
https://github.com/frappe/press/security/advisories/GHSA-68qm-vp8f-rpr3

Get alerted when CVE-2025-59421 or the next vulnerability affects your stack