CVE-2026-44207 National Vulnerability Database / 1d Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configuration details. This issue has been patched in versions 15.107.0 and 16.17.0.

nvd.nist.gov • June 13, 2026

This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configuration details. This issue has been patched in versions 15.107.0 and 16.17.0.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

IDOR Vulnerability in Frappe Framework Exposes User Email Configurations CVE-2026-44207 is an IDOR vulnerability in the Frappe web application framework, affecting versions prior to 15.107.0 and 16.17.0. Authenticated users could exploit this flaw to access other users' email configuration details. The vulnerability has been assigned a CVSS base score of 6.9, indicating a medium severity level. The issue was published on June 12, 2026, and has since been patched in the latest versions. Users of the affected versions are advised to update to mitigate potential risks. The vulnerability does not appear to have been actively exploited in the wild at this time. Security professionals should prioritize patching to prevent unauthorized access to sensitive information. 3 sources 57

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)