CVE-2026-109675: Authorization Bypass Through User-Controlled Key in frappe suite
Description
CVE-2026-109675 is an authorization bypass vulnerability in Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f. It affects the get_mailboxes and get_quota APIs, allowing authenticated mail users to access mailbox data of other users by supplying another user's JMAP account ID. This can expose mailbox names, message counts, automation rules with sender addresses, and storage quota usage. The vulnerability has a medium severity with a CVSS score of 5.3.
CVSS v4.0
Score 5.3medium
Affected software
frappe
suite
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Frappe Suite versions prior to commit 2697564a9c46da6acc614743eaf9915fe5238f4f contain a broken access control vulnerability in the get_mailboxes and get_quota APIs. Authenticated users can bypass authorization by providing another user's JMAP account ID, enabling them to read sensitive mailbox information such as mailbox names, message counts, automation rules including sender addresses, and storage quota usage. This flaw compromises user data confidentiality within the mail system.
Potential Impact
Authenticated mail users can access mailbox-related data belonging to other users, including mailbox names, message counts, automation rules with sender addresses, and storage quota usage. This unauthorized access can lead to privacy violations and potential information disclosure within the affected mail system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is fixed in the commit 2697564a9c46da6acc614743eaf9915fe5238f4f, users should update to a version including this commit or later. Until then, restrict access to authenticated mail users and monitor for suspicious activity related to mailbox data access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T21:08:17.598Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd63eb2cdf04f656e1eb57
Added to database: 10/12/2026, 22:49:15 UTC
Last enriched: 10/12/2026, 23:03:39 UTC
Last updated: 10/12/2026, 23:28:21 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.