EUVD-2026-36487Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requiring authenticated session (PR:L); read-only confidentiality impact limited to email config data; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configuration details. This issue has been patched in versions 15.107.0 and 16.17.0.
AnalysisAI
Insecure Direct Object Reference (IDOR) in the Frappe full-stack web application framework exposes email configuration details of arbitrary users to any authenticated account. The flaw exists in versions prior to 15.107.0 (v15 branch) and 16.17.0 (v16 branch), allowing a low-privilege authenticated attacker to enumerate and read email settings belonging to other users by manipulating object references in requests. No public exploit has been identified and the issue is not listed in CISA KEV, though the low EPSS score (0.02%) and network-accessible vector warrant patching, particularly for multi-tenant Frappe deployments.
Technical ContextAI
Frappe is a Python/JavaScript full-stack framework used as the foundation for ERPNext and other enterprise applications. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key), a subclass of IDOR where the application uses a caller-controlled value - such as a user ID or email configuration record ID - to look up sensitive objects without verifying the requestor's ownership or authorization over that object. The affected CPE is cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*, covering all Frappe framework installations across both the v15 and v16 release trains prior to the patched versions. The root cause is missing ownership or access control validation on the endpoint(s) that retrieve email configuration documents, meaning the server returns data based solely on the supplied key rather than enforcing that the authenticated session owns the referenced record.
RemediationAI
Upgrade Frappe to version 15.107.0 (v15 branch) or 16.17.0 (v16 branch) - these are the vendor-confirmed patched releases per the GitHub security advisory at https://github.com/frappe/frappe/security/advisories/GHSA-cw6v-39qx-7r74. If immediate patching is not feasible, restrict access to email configuration endpoints at the network or reverse-proxy layer to limit exposure to trusted administrative IP ranges, accepting the trade-off of reduced self-service functionality for end users. Additionally, audit email configuration records for any stored SMTP credentials or OAuth tokens and consider rotating them if the deployment is multi-user or internet-exposed, since those values may have been readable by unauthorized authenticated users prior to patching. No framework-level workaround is documented; patching is the only confirmed remediation.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportv
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the fra
In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. Rated medium severity (CVSS
public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and
SQL injection in Frappe framework before 15.84.0/14.99.0.
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. Rated critical severity (CVSS 9.8), this vulner
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execu
SQL injection in Frappe's bulk_update function enables unauthenticated remote attackers to execute arbitrary SQL command
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today