CVE-2026-116492
Received Received - Intake

Missing Authorization in Frappe CRM Lets Low-Privileged Users Access CRM Lead Records

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116492
EUVD
EUVD-2026-109789

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frappe crm 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Frappe CRM versions before 1.89.1 have a missing authorization vulnerability (CVE-2026-116492) where authenticated low-privileged users can read CRM Lead records they are not permitted to access. The vulnerability exists in the get_contact_by_phone_number API, which performs raw database queries without enforcing permission checks. Attackers can supply a known phone number to this endpoint to retrieve full lead details that should be blocked by standard access controls.

Detection Guidance

Check if your Frappe CRM version is below 1.89.1 by running: grep version apps/frappe/crm/config/software_versions.json. If the version is lower, the vulnerability may be present. Test the API endpoint by sending a request with a known phone number to /api/method/crm.integrations.api.get_contact_by_phone_number and verify if unauthorized lead details are returned.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive CRM data, including lead records containing personal or confidential information. Attackers with low privileges can exploit this to retrieve full lead details by querying phone numbers, potentially leading to data breaches, privacy violations, or misuse of sensitive information.

Compliance Impact

This vulnerability can lead to unauthorized access and disclosure of personal data, violating GDPR's principles of data protection and user consent. For HIPAA, it risks exposing protected health information without authorization. Compliance failures may result in legal penalties, fines, and reputational damage due to compromised data security.

Mitigation Strategies

Upgrade Frappe CRM to version 1.89.1 or later immediately. Apply the security patch from the official repository or update via your package manager. Review API access logs for suspicious queries to the get_contact_by_phone_number endpoint and restrict low-privileged user permissions until the update is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116492. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart