Threats tagged 'ghsa-qmcv-7jcv-gffw'

Frappe CRM app versions before 1.89.1 have a missing authorization vulnerability that allows authenticated low-privileged users to access CRM Lead records they should not be able to see. This occurs because the get_contact_by_phone_number API endpoint performs raw database queries without enforcing permission checks, enabling unauthorized disclosure of sensitive lead data by supplying a known phone number.