Auth bypass in Frappe Crm
CVE-2026-111938
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/frappe/crm/security/advisories/GHSA-843p-qp2f-p2v8 (vendor-advisory)
- github.com/frappe/crm/commit/7872f4d178bd9338dba2eb4fc4808f4060914be6 (patch)
- github.com/frappe/crm/commit/e30df91094033d8583a72e429726ba7bebc1534f (patch)
- github.com/frappe/crm/releases/tag/v1.74.0 (release-notes)
- github.com/frappe/crm/blob/v1.73.2/crm/integrations/api.py (technical-description)
- www.vulncheck.com/advisories/frappe-crm-before-1.74.0-missing-authorization-via… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-111938?
- CVE-2026-111938 is a medium-severity vulnerability in Frappe Crm, classified under Missing Authorization. CVSS score: 4.3/10. Published 2026-10-19.
- How severe is CVE-2026-111938?
- Medium severity. CVSS v3 base score is 4.3 out of 10.