CVE-2026-116492 Details
Description
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.
A missing authorization vulnerability has been identified in the Frappe CRM application, affecting versions prior to 1.89.1. This vulnerability allows authenticated low-privileged users to access CRM Lead records that should be restricted. The issue arises from the 'get_contact_by_phone_number' API, which executes raw database queries without applying the necessary permission checks. By providing a known phone number to this endpoint, users can retrieve full lead details that are otherwise protected by standard API and UI access controls. This exploitation leads to unauthorized disclosure of sensitive CRM information.
Users can upgrade to Frappe CRM version 1.89.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frappe/crm/pull/3103 | [email protected] | Issue TrackingVendor |
| https://github.com/frappe/crm/releases/tag/v1.89.1 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/frappe-crm-before-missing-authorization-via-phone-lookup-api | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe CRM | >= 1.0.0, < 1.89.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |