Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs

Advisories

Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs

severity: medium
date: 10/12/2026
Affecting: suite >= 0, < 2697564a9c46da6acc614743eaf9915fe5238f4f
CVE: CVE-2026-109675
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References: GitHub Security Advisory (GHSA-4gv8-m97c-4jmv)
Credit: Darshan060224
Description: Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo