CVE-2026-109675 | Frappe Suite APIs get_mailboxes/get_quota JMAP account ID access control

October 13, 2026 Yanac

A vulnerability classified as problematic has been found in Frappe Suite. This vulnerability affects the function get_mailboxes/get_quota of the component APIs. This manipulation of the argument JMAP account ID causes improper access controls.

The identification of this vulnerability is CVE-2026-109675. It is possible to initiate the attack remotely. There is no exploit available.

It is suggested to install a patch to address this issue.VulDB Recent EntriesRead More