CVE-2026-111938
Received Received - Intake

Authentication Bypass in Frappe CRM Allows Call Log Manipulation

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111938
EUVD
EUVD-2026-104313

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frappe crm 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111938 is a missing authorization vulnerability in Frappe CRM versions before 1.74.0. It allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can use the add_note_to_call_log and add_task_to_call_log endpoints to attach malicious notes and tasks to victims' call logs, which then appear on leads and deals.

Detection Guidance

Check if your Frappe CRM version is below 1.74.0 by running: grep -r 'version' /path/to/frappe/crm. If the version is older, the system is vulnerable. Inspect API endpoints for add_note_to_call_log and add_task_to_call_log in crm/integrations/api.py to see if permission checks are missing.

Impact Analysis

This vulnerability allows attackers with Sales User access to manipulate call logs by adding fake notes or tasks. This could lead to data integrity issues, misinformation in records, or unauthorized modifications affecting business decisions. The impact is limited to authenticated users with Sales roles but can disrupt CRM data accuracy.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications to call logs, which may contain sensitive personal or health information. Unauthorized changes to such records could violate data integrity requirements under these regulations, leading to non-compliance and potential legal consequences.

Mitigation Strategies

Upgrade Frappe CRM to version 1.74.0 or later immediately. Verify the fix by checking that add_note_to_call_log and add_task_to_call_log now include permission validation for the CRM Call Log resource.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111938. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart