CVE-2026-53761
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Frappe CRM prior to version 1.73.0 has an authentication bypass vulnerability via logged invitation keys in crm/api. An attacker can exploit these keys to gain unauthorized access.
Risk Assessment
The risk includes unauthorized access to the CRM system, potentially leading to confidentiality breaches of customer data.
Recommendation
Upgrade Frappe CRM to version 1.73.0 or later, which fixes this vulnerability.
Other vulnerabilities in Frappe CRM
See all- CVE-2026-108734Medium
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
- CVE-2025-68928Medium
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue.
Original NVD description (English source)
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS