CVE-2026-44207
Description
An IDOR vulnerability in Frappe before 15.107.0 and 16.17.0 allows authenticated users to access other users' email configuration details.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An IDOR vulnerability in Frappe before 15.107.0 and 16.17.0 allows authenticated users to access other users' email configuration details.
Vulnerability
The vulnerability is an Insecure Direct Object Reference (IDOR) in Frappe Framework prior to versions 15.107.0 and 16.17.0. Authenticated users can access other users' email configuration details due to missing authorization checks. The affected versions are all releases before the patched versions [1].
Exploitation
An attacker must have a valid authenticated session. No special privileges beyond regular user access are required. By manipulating object references (e.g., API parameters), the attacker can enumerate or retrieve email configuration details of other users [1].
Impact
Successful exploitation leads to unauthorized disclosure of other users' email configuration details, which may include sensitive information such as email server credentials or personal email addresses. The confidentiality of user data is compromised [1].
Mitigation
Patches are available in versions 15.107.0 and 16.17.0. Users should upgrade to these versions immediately. There are no workarounds, as stated in the advisory [1].
AI Insight generated on Jun 12, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
27f508f2793cffix(email_account): add perm. check to set_email_password
1 file changed · +5 −0
frappe/email/doctype/email_account/email_account.py+5 −0 modified@@ -1127,7 +1127,12 @@ def remove_user_email_inbox(email_account): @frappe.whitelist() +<<<<<<< HEAD def set_email_password(email_account, password): +======= +def set_email_password(email_account: str, password: str): + frappe.has_permission("Email Account", "write", email_account, throw=True) +>>>>>>> dd9450dc46 (fix(email_account): add perm. check to set_email_password) account = frappe.get_doc("Email Account", email_account) if account.awaiting_password and account.auth_method != "OAuth": account.awaiting_password = 0
0fe914732ed2chore(release): Bumped to Version 15.107.0
1 file changed · +1 −1
frappe/__init__.py+1 −1 modified@@ -51,7 +51,7 @@ ) from .utils.lazy_loader import lazy_import -__version__ = "15.106.0" +__version__ = "15.107.0" __title__ = "Frappe Framework" # This if block is never executed when running the code. It is only used for
Vulnerability mechanics
Root cause
"Missing permission check in the `set_email_password` whitelisted method allows any authenticated user to modify another user's email account password."
Attack vector
An authenticated user can call the `set_email_password` whitelisted endpoint with an arbitrary `email_account` name and a new password. Because the method did not verify that the caller has write permission on the target Email Account, the attacker can overwrite the email password of any other user's email configuration [patch_id=5723740]. This is an Insecure Direct Object Reference (IDOR) vulnerability.
Affected code
The vulnerability exists in the `set_email_password` whitelisted method in `frappe/email/doctype/email_account/email_account.py`. The method lacked a permission check before allowing an authenticated user to set the password on any Email Account document.
What the fix does
The patch adds a call to `frappe.has_permission("Email Account", "write", email_account, throw=True)` at the top of `set_email_password`, which enforces that the caller must have write-level permission on the specific Email Account document before the password can be changed [patch_id=5723740]. If the permission check fails, the request is rejected with an exception, closing the IDOR gap.
Preconditions
- authThe attacker must be an authenticated user of the Frappe application.
- inputThe attacker must know or guess the name of another user's Email Account document.
Generated on Jun 12, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.