CVE-2026-109675 in Suite
Summary
by MITRE • 10/13/2026
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability represents a critical failure in server-side access control mechanisms within the Frappe Suite prior to commit 2697564a9c46da6acc614743eaf9915fe5238f4f. Specifically, this flaw resides in two Application Programming Interface endpoints: get_mailboxes and get_quota. These APIs are designed to retrieve information regarding a user's email infrastructure, including mailbox configurations and storage limits. However, the implementation fails to adequately validate whether the requesting authenticated session possesses authorization for the specific resource being accessed. Instead of binding the retrieved data strictly to the identity of the currently logged-in user or validating that the requested account ID matches the authorized context, the system relies on client-supplied input without sufficient server-side verification. This architectural oversight allows an attacker who has valid credentials for one mail user to manipulate API parameters and request data associated with a different JMAP account ID.
The technical nature of this flaw is classified as Broken Access Control, which aligns directly with CWE-284 in the Common Weakness Enumeration taxonomy. The vulnerability exploits the lack of proper authorization checks on sensitive endpoints that handle personal communication metadata. By supplying an arbitrary or known JMAP account identifier to these APIs, a malicious actor can bypass intended isolation boundaries between users. This is not merely an information disclosure issue but a fundamental breach of multi-tenant security principles where data belonging to one entity becomes accessible to another without privilege escalation in terms of login credentials. The attacker does not need to compromise the victim's password; they only need their own valid authentication token and knowledge or enumeration capability regarding other users' account identifiers within the same instance.
The operational impact of this vulnerability is severe due to the sensitivity of the data exposed through these endpoints. An authenticated user can retrieve mailbox names, which may reveal organizational structures, project codes, or internal naming conventions that are valuable for further reconnaissance campaigns. More critically, the ability to access message counts and automation rules with sender addresses provides deep insight into communication patterns and automated workflows. Automation rules often contain logic based on specific senders or subjects, exposing business-critical processes such as invoice processing alerts, customer support routing, or executive notifications. Furthermore, accessing storage quota usage can aid in profiling target resources for potential denial-of-service attacks by identifying high-value targets with significant data stores. This level of visibility effectively neutralizes the confidentiality guarantees expected from a secure email management system.
From an offensive security perspective, this vulnerability maps to several techniques within the MITRE ATT&CK framework. The initial exploitation aligns with T1078 Valid Accounts, as it requires legitimate credentials but leverages them improperly. The act of accessing data belonging to other users falls under T1530 Data from Cloud Storage or more specifically T1213 Information Discovery if viewed through the lens of gathering intelligence about peers within an organization. In a multi-tenant SaaS environment, this is particularly dangerous as it facilitates lateral movement and cross-account espionage without triggering typical anomaly detection systems that focus on brute force or credential stuffing rather than authorized but unauthorized access patterns.
To mitigate this vulnerability, immediate action must be taken to upgrade the Frappe Suite installation to a version released after commit 2697564a9c46da6acc614743eaf9915fe5238f4f, which contains the necessary patches for these access control flaws. For organizations unable to patch immediately due to operational constraints, temporary mitigations should focus on restricting API endpoint accessibility through network-level controls or web application firewalls that validate session tokens against requested resource ownership at a proxy level before reaching the application logic. Additionally, developers must implement strict server-side validation in all API handlers ensuring that any identifier passed by the client is cross-referenced with the authenticated user's profile data to ensure they match exactly. This principle of least privilege and explicit authorization checks should be applied universally across all endpoints handling sensitive personal or organizational data to prevent similar access control bypasses in other parts of the suite.