CVE-2026-53761: Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe CRMto a version that resolves this vulnerability.Fixed in 1.73.0
Event History
Frequently Asked Questions
Which Frappe CRM deployments are affected?
Frappe CRM versions before 1.73.0 are affected. The issue is patched in version 1.73.0.
What must an attacker obtain to exploit this issue?
The attacker would need access to invitation keys that were logged by the crm/api component. Those logged keys can enable authentication bypass.
What should teams do if they cannot patch immediately?
Restrict access to logs containing crm/api invitation keys and treat any exposed logged invitation keys as sensitive credentials. Upgrade to Frappe CRM 1.73.0 as soon as possible.