CVE-2026-111938— Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
Quick assessment
Affected
frappe crm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe CRM 1.74.0 之前的版本存在一个缺失授权（missing authorization）的漏洞，允许已认证的“销售用户”通过提供任意 值来修改其他用户的通话记录。攻击者可调用 和 接口，将攻击者撰写的备注和任务附加到受害者的通话记录、潜在客户（leads）及交易（deals）中，从而在受害者界面显示这些伪造内容。
Possible ATT&CK Techniques 2 AI
T1078 · Valid Accounts T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111938
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-111938
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111938
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-111938 (1)
Vendor Advisories for CVE-2026-111938 (2)
Vendor Pages for CVE-2026-111938 (2)
-
🔗 crm/crm/integrations/api.py at v1.73.2 · frappe/crm · GitHub Read full article technical-description
-
🔗 Release v1.74.0 · frappe/crm · GitHub release-notes
Same Patch Batch · frappe · 2026-10-19 · 3 CVEs total
| CVE-2026-111937 | 5.4 MEDIUM | Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records |
| CVE-2026-111939 | 4.6 MEDIUM | Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation |
IV. Related Vulnerabilities
Same product: crm
-
CVE-2026-111937
Frappe CRM before 1.81.2 Missing Authorization on CRM Notifi -
CVE-2026-108734
Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via g -
CVE-2021-48008
Chanjet CRM SQL Injection via get_usedspace.php -
CVE-2026-92418
ChangeWeDer crm Save Endpoint customer.serve.js cross site s -
CVE-2026-92402
ChangeWeDer crm top.upstudy.crm.controller.UserController Us
Same vendor: frappe
-
CVE-2026-111939
Frappe Helpdesk before 1.26.0 Authorization Bypass via raise -
CVE-2026-111937
Frappe CRM before 1.81.2 Missing Authorization on CRM Notifi -
CVE-2026-64862
Frappe HR: Missing Authorization on PWA API Endpoints enable -
CVE-2026-55796
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Rep -
CVE-2026-108373
ERPNext: Unauthorised access to financial data due to missin
Same weakness: CWE-862
-
CVE-2026-113660
ApostropheCMS: Authenticated Object-Level Authorization Bypa -
CVE-2026-113649
ApostropheCMS: Import API bypasses publication roles for pro -
CVE-2026-112957
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses -
CVE-2026-113677
Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDo -
CVE-2026-113612
SparkyFitness before 0.17.0 Missing Authorization via food-v
V. Comments for CVE-2026-111938
No comments yet