CVE-2026-108734
MediumCVSS 4.3Summary
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
Risk Assessment
An attacker can access confidential information such as phone numbers, organization data, and notification content, leading to privacy breaches and data leakage. The risk also includes using this information for further social engineering attacks.
Recommendation
Update Frappe CRM to a version later than 1.87.0 if available, and implement permission checks in the get_linked_docs_of_document method. Audit access logs for linked documents for unauthorized reads.
Other vulnerabilities in Frappe CRM
See all- CVE-2026-53761High
Frappe CRM prior to version 1.73.0 has an authentication bypass vulnerability via logged invitation keys in crm/api. An attacker can exploit these keys to gain unauthorized access.
- CVE-2025-68928Medium
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue.
Original NVD description (English source)
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS