---
id: CVE-2026-109675
title: >-
  Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a
  broken access control vulnerability in the get_mailboxes and get_quota APIs
  that allows authenticated mail users to access other users' data
summary: >-
  Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a
  broken access control vulnerability in the get_mailboxes and get_quota APIs
  that allows authenticated mail users to access other users' data. Attackers
  can su…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:35.543'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109675'
references:
  - url: 'https://github.com/frappe/suite/security/advisories/GHSA-4gv8-m97c-4jmv'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-suite-before-commit-2697564-broken-access-control-in-mail-mailbox-and-quota-apis
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.644Z'
---

## Overview

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.