An IDOR vulnerability in the Frappe framework lets an authenticated user read the email configuration details of other users, exposing information such as email addresses and other email‑related settings. The weakness is a Direct Object Reference (CWE‑639).

All builds of the Frappe framework older than version 15.107.0 in the 15.x line and before 16.17.0 in the 16.x line are affected.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. Because the flaw requires an authenticated user, an attacker must first obtain valid credentials to exploit the vulnerability. The vulnerability is not listed in CISA’s KEV catalog.