Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-111937

Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Crm Frappe Crm
CVE-2026-111938

Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Crm Frappe Crm
CVE-2026-108734

Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document

Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Crm
CVE-2026-53761

Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Crm