CVE-2026-111938: Missing Authorization in frappe crm
Description
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
CVSS v4.0
Score 5.3medium
Affected software
frappe
crm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111938 is a missing authorization vulnerability in Frappe CRM prior to version 1.74.0. Authenticated users with Sales User privileges can exploit this flaw by calling the add_note_to_call_log and add_task_to_call_log endpoints with arbitrary call_sid values. This allows them to attach attacker-controlled notes and tasks to other users' call logs, leads, and deals, effectively modifying data they should not have access to.
Potential Impact
The vulnerability enables unauthorized modification of call logs and related records by authenticated Sales Users. This can lead to data integrity issues, misinformation in call logs, leads, and deals, potentially impacting business operations and trustworthiness of CRM data.
Mitigation Recommendations
A fix is available in Frappe CRM version 1.74.0. Users should upgrade to version 1.74.0 or later to remediate this vulnerability. No vendor advisory was provided, so check the official Frappe CRM release notes or security advisories for confirmation and further guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-17T12:20:52.372Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad623772cdf04f6565c87fb
Added to database: 10/19/2026, 14:04:39 UTC
Last enriched: 10/19/2026, 14:19:18 UTC
Last updated: 10/19/2026, 19:06:46 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.