Broken Access Control in Frappe Suite Affects User Mailbox Security
CVE-2026-109675

5.3MEDIUM

Key Information:

Vendor

Frappe

Status
Suite
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109675?

Frappe Suite versions prior to commit 2697564a9c46da6acc614743eaf9915fe5238f4f exhibit a broken access control flaw in the get_mailboxes and get_quota APIs. This vulnerability allows authenticated mail users to access sensitive information from other users by exploiting the ability to provide another user's JMAP account ID. Attackers can retrieve mailbox names, message counts, automation rules containing sender addresses, and storage quota usage, thereby compromising the confidentiality and integrity of user data.

Affected Version(s)

suite 0 < 2697564a9c46da6acc614743eaf9915fe5238f4f

suite 2697564a9c46da6acc614743eaf9915fe5238f4f

References

https://github.com/frappe/suite/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/frappe-suite-before-...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Darshan060224
.