Suite
Monthly
Broken access control in Frappe Suite's JMAP mail APIs allows authenticated mail users to read other accounts' mailbox metadata by supplying a victim's JMAP account ID. Affected deployments are any Frappe Suite build prior to commit 2697564a9c46da6acc614743eaf9915fe5238f4f that runs the Mail service with more than one account; a valid low-privileged mail login (PR:L) is required, and the impact is read-only disclosure of mailbox names, message counts, automation rules containing sender addresses, and storage quota usage rather than message contents. No public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), keeping this a moderate-severity (CVSS 5.3) information-disclosure issue.
Broken access control in Frappe Suite's JMAP mail APIs allows authenticated mail users to read other accounts' mailbox metadata by supplying a victim's JMAP account ID. Affected deployments are any Frappe Suite build prior to commit 2697564a9c46da6acc614743eaf9915fe5238f4f that runs the Mail service with more than one account; a valid low-privileged mail login (PR:L) is required, and the impact is read-only disclosure of mailbox names, message counts, automation rules containing sender addresses, and storage quota usage rather than message contents. No public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), keeping this a moderate-severity (CVSS 5.3) information-disclosure issue.