CVE-2026-116492
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls.
Risk Assessment
A low-privileged attacker can access sensitive CRM data that should be protected. This risks unauthorized disclosure of business information.
Recommendation
Update Frappe CRM to version 1.89.1 or later. Until the update, consider restricting access to the get_contact_by_phone_number endpoint.
Other vulnerabilities in Frappe CRM
See all- CVE-2026-111938Medium
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
- CVE-2026-111937Medium
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
- CVE-2026-108734Medium
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
- CVE-2026-53761High
Frappe CRM prior to version 1.73.0 has an authentication bypass vulnerability via logged invitation keys in crm/api. An attacker can exploit these keys to gain unauthorized access.
- CVE-2025-68928Medium
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue.
- CVE-2025-11461High
Multiple SQL injections exist in the Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This affects Frappe CRM 1.53.1.
Original NVD description (English source)
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS