CVE-2026-111938

MEDIUM 4.3

Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.

CWE	CWE-862
Vendor	frappe
Product	crm
Published	Oct 19, 2026
Last Updated	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for frappe crm

Be the first to know when new medium vulnerabilities affecting frappe crm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

frappe / crm

0 < 1.74.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/crm/security/advisories/GHSA-843p-qp2f-p2v8 github.com: https://github.com/frappe/crm/commit/7872f4d178bd9338dba2eb4fc4808f4060914be6 github.com: https://github.com/frappe/crm/commit/e30df91094033d8583a72e429726ba7bebc1534f github.com: https://github.com/frappe/crm/releases/tag/v1.74.0 github.com: https://github.com/frappe/crm/blob/v1.73.2/crm/integrations/api.py vulncheck.com: https://www.vulncheck.com/advisories/frappe-crm-before-1.74.0-missing-authorization-via-add-note-to-call-log

Credits

George Chen