CVE-2026-111938
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
Risk Assessment
An attacker can inject fake notes and tasks into other users' records, potentially leading to misinformation and disruption of sales processes. Only Sales user authentication is required.
Recommendation
Upgrade Frappe CRM to 1.74.0 or later. Until patched, restrict Sales user permissions and monitor for unusual call log modifications.
Other vulnerabilities in Frappe CRM
See all- CVE-2026-116492Medium
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls.
- CVE-2026-111937Medium
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
- CVE-2026-108734Medium
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
- CVE-2026-53761High
Frappe CRM prior to version 1.73.0 has an authentication bypass vulnerability via logged invitation keys in crm/api. An attacker can exploit these keys to gain unauthorized access.
- CVE-2025-68928Medium
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue.
- CVE-2025-11461High
Multiple SQL injections exist in the Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This affects Frappe CRM 1.53.1.
Original NVD description (English source)
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS