CVE-2026-109675Medium· 4.3▾ SunlitFrappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can su…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111939Medium· 4.6Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
CVE-2026-116492Medium· 6.5Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
CVE-2026-115717High· 7.7Frappe Builder before 1.36.1 SSRF via convert_to_webp
CVE-2026-115718Medium· 4.3Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt
CVE-2026-115720Medium· 5.0Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect
CVE-2026-114664High· 7.1Frappe before 16.33.0 Blind SQL Injection via get_events