Frappe Framework EUVD-2026-36487

Exploitation requires an active authenticated session on the Frappe instance - any user account regardless of role or privilege level is sufficient. The attacker must be able to supply or enumerate a valid object reference (record ID or user identifier) for a target user's email configuration record; Frappe record IDs are often predictable or enumerable within the application. No special configuration, non-default feature flag, or elevated privilege is required beyond basic authentication. Exploitation is limited by the requirement for prior authentication, meaning unauthenticated external attackers cannot directly exploit this flaw. The impact is also bounded to read-only access of email configuration data (no write, delete, or code execution path is described).

The provided CVSS 4.0 vector (6.9, AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) indicates no privileges required, which directly conflicts with the CVE description stating exploitation requires an authenticated user - this discrepancy should be verified against the vendor advisory at GHSA-cw6v-39qx-7r74. Treating the description as authoritative, the realistic attack profile is network-accessible but requires authentication (PR:L), reducing real-world exploitability compared to the raw vector implies. The confidentiality impact is limited to email configuration details (VC:L) with no integrity or availability impact, making this a moderate-priority information disclosure issue rather than a critical escalation path. EPSS at 0.02% (7th percentile) confirms very low observed exploitation probability, and the absence of KEV listing and public POC further supports treating this as a patch-cycle rather than emergency priority. The most meaningful risk is in multi-tenant SaaS deployments of Frappe or ERPNext where email credentials (SMTP passwords, OAuth tokens) stored in email configuration records could be harvested across tenant boundaries.

An attacker with any valid Frappe account - such as a low-privilege employee or contractor account in an ERPNext deployment - sends a crafted HTTP request to the email configuration retrieval endpoint, substituting another user's record identifier for their own. The server returns the target user's email configuration details, potentially including stored SMTP credentials or OAuth tokens, without validating ownership. No public exploit code has been identified at the time of analysis.