CVE-2026-109675
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-639
Impact
Authenticated mail users can view other users' mailbox metadata, message counts, automation rules, and quota usage. An attacker needs network access and valid mail user credentials to supply target JMAP account IDs.
Root cause
The get_mailboxes and get_quota APIs fail to enforce authorization checks against the requested JMAP account ID.
Affected systems
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Update Frappe Suite to commit 2697564a9c46da6acc614743eaf9915fe5238f4f or later. No interim mitigation is provided in the advisory.
$ bench update --apps suiteAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.