ERPNext's Document Follow feature exposed unauthorized data (robinroy.xyz)

This is a security write-up about a chain of vulnerabilities I discovered in the Frappe framework (the framework ERPNext is built on).