CVE-2026-109675: Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated mail user can exploit it. The attacker needs to provide another user's JMAP account ID to the affected APIs.
What information could be exposed?
An attacker may read another user's mailbox names, message counts, automation rules including sender addresses, and storage quota usage. The available data indicates information disclosure, not modification or service disruption.
Are unauthenticated or default deployments affected?
The issue requires authentication as a mail user, so unauthenticated attackers are not described as able to exploit it. The provided data does not state whether a default configuration exposes the affected APIs.
How can I determine whether my deployment is affected?
Deployments running Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f are affected. You can also test authorization controls for get_mailboxes and get_quota by using one authenticated user's session with a different user's JMAP account ID.