CVE-2026-108734: Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.getlinkeddocsofdocument that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to Frappe CRM and have the ability to invoke the affected linked-document lookup. The attacker can target a lead, deal, comment, or user record that they are not otherwise permitted to read.
What information could be exposed?
The affected function can disclose linked call log phone numbers, deal organizations, and mention notification text associated with inaccessible records. The stated impact is limited to unauthorized reading; no integrity or availability impact is described.
Are unauthenticated users affected?
No. The vulnerability requires low-privileged authenticated access, as reflected by the PR:L vector and the description's authenticated-user requirement.
How can I determine whether my deployment is affected?
Check whether Frappe CRM is running a version from 1.49.0 through 1.87.0. On an affected version, an authenticated low-privilege account may be able to request linked documents for a lead, deal, comment, or user it cannot normally read and receive the linked information.