Missing Authorization Vulnerability in Frappe CRM Affects Sales Users

CVE-2026-111938

What is CVE-2026-111938?

Frappe CRM versions prior to 1.74.0 are susceptible to a missing authorization vulnerability that enables authenticated Sales Users to tamper with the call logs of other users. By exploiting this flaw, an attacker can input arbitrary call_sid values, thereby invoking the add_note_to_call_log and add_task_to_call_log endpoints. This allows attackers to append custom notes and tasks that become visible on the affected users' call logs, leads, and deals, facilitating data manipulation and unauthorized access to sensitive information.

References