Missing Authorization Flaw in Frappe CRM App Affects Sensitive Data Access

CVE-2026-116492

What is CVE-2026-116492?

The Frappe CRM application, prior to version 1.89.1, presents a significant vulnerability due to missing authorization checks. This issue permits authenticated low-privileged users to access sensitive CRM Lead records that should remain restricted. By invoking the get_contact_by_phone_number API, attackers can exploit this flaw to perform raw database queries that bypass standard permission controls. By submitting a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint, unauthorized users can gain access to complete lead details that are meant to be safeguarded, ultimately leading to an unauthorized disclosure of sensitive data.

References