CVE-2026-108734

Name of the Vulnerable Software and Affected Versions Frappe CRM versions 1.49.0 through 1.87.0

Description An issue exists where authenticated users can read linked documents without proper permission checks. By specifying a lead, deal, comment, or user they are not authorized to access, an attacker can retrieve sensitive information via the crm.api.doc.get linked docs of document endpoint. This information may include call log phone numbers, deal organizations, and mention notification text.

Recommendations Update Frappe CRM to a version later than 1.87.0. As a temporary mitigation, restrict access to the crm.api.doc.get linked docs of document endpoint.