Back cve.report

CVE-2026-44207 CVE Vulnerability Disclosures / 1d Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configuration details. This issue has been patched in versions 15.107.0 and 16.17.0.

cve.report • June 13, 2026

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS: 0.000240000 probability, percentile 0.072310000 (date 2026-06-12)

Problem Types: CWE-639 | CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

IDOR Vulnerability in Frappe Framework Exposes User Email Configurations CVE-2026-44207 is an IDOR vulnerability in the Frappe web application framework, affecting versions prior to 15.107.0 and 16.17.0. Authenticated users could exploit this flaw to access other users' email configuration details. The vulnerability has been assigned a CVSS base score of 6.9, indicating a medium severity level. The issue was published on June 12, 2026, and has since been patched in the latest versions. Users of the affected versions are advised to update to mitigate potential risks. The vulnerability does not appear to have been actively exploited in the wild at this time. Security professionals should prioritize patching to prevent unauthorized access to sensitive information. 3 sources 57

Extracted Entities

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Vulnerabilities (1)