CVE-2026-44207: Frappe: Insecure Direct Object Reference for email accounts

Q: What is the severity of CVE-2026-44207?

CVE-2026-44207 has a medium severity rating of 6.9 based on the CVSS score.

Q: Who is affected by CVE-2026-44207?

CVE-2026-44207 affects authenticated users of the Frappe framework prior to versions 15.107.0 and 16.17.0.

Q: How do I fix CVE-2026-44207?

To fix CVE-2026-44207, upgrade to Frappe versions 15.107.0 or 16.17.0 or later.

Q: What type of vulnerability is CVE-2026-44207?

CVE-2026-44207 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.

Q: What does CVE-2026-44207 allow attackers to do?

CVE-2026-44207 allows authenticated users to access other users' email configuration details.

Published Jun 12, 2026

Updated

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configuration details. This issue has been patched in versions 15.107.0 and 16.17.0.

Affected Software

1 affected component

Frappe frappe<15.107.0, <16.17.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 15.107.0
Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 16.17.0

Event History

Jun 12, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-44207?

CVE-2026-44207 has a medium severity rating of 6.9 based on the CVSS score.

Who is affected by CVE-2026-44207?

CVE-2026-44207 affects authenticated users of the Frappe framework prior to versions 15.107.0 and 16.17.0.

How do I fix CVE-2026-44207?

To fix CVE-2026-44207, upgrade to Frappe versions 15.107.0 or 16.17.0 or later.

What type of vulnerability is CVE-2026-44207?