CVE-2026-108734: Missing Authorization in frappe crm
Description
Frappe CRM versions 1.49.0 through 1.87.0 have a missing authorization vulnerability in the crm.api.doc.get_linked_docs_of_document function. This flaw allows authenticated users to access linked documents without proper permission checks. Exploiting this, attackers can read linked call log phone numbers, deal organizations, and mention notification text associated with leads, deals, comments, or users they are not authorized to view.
CVSS v4.0
Score 5.3medium
Affected software
frappe
crm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108734 is a missing authorization vulnerability affecting Frappe CRM versions 1.49.0 through 1.87.0. The vulnerability exists in the crm.api.doc.get_linked_docs_of_document function, which fails to enforce permission checks when retrieving linked documents. Authenticated users can exploit this to access sensitive linked data such as call log phone numbers, deal organizations, and mention notification text related to leads, deals, comments, or users they should not have access to.
Potential Impact
The vulnerability allows authenticated users to bypass authorization controls and read sensitive linked documents and data they are not permitted to access. This can lead to unauthorized disclosure of call log phone numbers, organizational details of deals, and notification texts, potentially exposing confidential business information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to the minimum necessary and monitor for unusual access patterns related to linked document retrieval.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-11T01:52:48.413Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acb85c22cdf04f656d09a24
Added to database: 10/11/2026, 12:49:06 UTC
Last enriched: 10/11/2026, 13:04:10 UTC
Last updated: 10/11/2026, 21:33:17 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.