CVE-2026-111938: Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Q: Who can exploit this issue?

An authenticated user with the Sales User role can exploit it. The attacker must be able to submit arbitrary call_sid values to the affected endpoints.

Q: What can an attacker change?

An attacker can use add_note_to_call_log and add_task_to_call_log to add attacker-controlled notes and tasks to other users' call logs. These additions can also appear on the affected victims' leads and deals.

Q: Which versions require remediation?

Frappe CRM versions before 1.74.0 are affected. Upgrade to version 1.74.0 or later.

Published Oct 19, 2026

Updated

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.

Affected Software

1 affected component

Frappe Frappe CRM<1.74.0

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with the Sales User role can exploit it. The attacker must be able to submit arbitrary call_sid values to the affected endpoints.

What can an attacker change?

An attacker can use add_note_to_call_log and add_task_to_call_log to add attacker-controlled notes and tasks to other users' call logs. These additions can also appear on the affected victims' leads and deals.

Which versions require remediation?

Frappe CRM versions before 1.74.0 are affected. Upgrade to version 1.74.0 or later.

CVE-2026-111938: Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Which versions require remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Which versions require remediation?