Description
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
Title Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
First Time appeared Frappe
Frappe frappe Crm
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:frappe_crm:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe frappe Crm
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Frappe Crm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T16:35:11.497Z

Reserved: 2026-10-17T12:20:52.372Z

Link: CVE-2026-111938

cve-icon Vulnrichment

Updated: 2026-10-19T15:35:55.103Z

cve-icon NVD

Status : Received

Published: 2026-10-19T14:17:01.503

Modified: 2026-10-19T17:17:06.460

Link: CVE-2026-111938

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T15:30:16Z

Weaknesses