PT-2026-117400 · Frappe · Frappe Crm
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Frappe CRM versions prior to 1.74.0
Description
Authenticated Sales Users can modify call logs belonging to other users due to missing authorization. By providing arbitrary
call sid values, an attacker can use the 'add note to call log' and 'add task to call log' endpoints to attach unauthorized notes and tasks to the call logs, leads, and deals of other users.Recommendations
Update Frappe CRM to version 1.74.0 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Frappe Crm