CVE-2026-109675

MEDIUM 4.3

Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.

CWE	CWE-639
Vendor	frappe
Product	suite
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for frappe suite

Be the first to know when new medium vulnerabilities affecting frappe suite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

frappe / suite

0 < 2697564a9c46da6acc614743eaf9915fe5238f4f

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/suite/security/advisories/GHSA-4gv8-m97c-4jmv vulncheck.com: https://www.vulncheck.com/advisories/frappe-suite-before-commit-2697564-broken-access-control-in-mail-mailbox-and-quota-apis

Credits

🔍 Darshan060224