CVE-2026-44207

6.9 mediumEPSS 0.3%

Medium (6.9). EPSS 0.3% chance of exploitation in the next 30 days.

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configuration details. This issue has been patched in versions 15.107.0 and 16.17.0.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-06-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/frappe/frappe/security/advisories/GHSA-cw6v-39qx-7r74

Check your stack JSON