A broken access control flaw exists in the get_mailboxes and get_quota APIs of Frappe Suite. The APIs let an authenticated mail user supply another user's JMAP account ID, enabling the attacker to read the target's mailbox names, message counts, automation rules that include sender addresses, and storage quota usage. This grants an attacker access to sensitive user data without permission. The weakness is classified as CWE-639, a breach of expected authorization controls.

Products from the Frappe Suite, including all versions released before commit 2697564 (commit hash a9c46da6acc614743eaf9915fe5238f4f). Any deployment that has not rolled forward beyond this commit is vulnerable. The vendor is Frappe, and the affected software is the Frappe Suite.

The vulnerability scores a CVSS of 5.3, indicating medium severity. EPSS information is unavailable, and the issue has not been listed in CISA’s KEV catalog, so public exploitation data is not known. Because an attacker must be an authenticated mail user to leverage the API, the attack vector is remote but requires valid credentials. The risk is medium; an insider or compromised user could glean other users’ personal mailbox information and quota usage.