CVE-2026-116492— Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API

Quick assessment

Affected

frappe crm

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Frappe CRM 应用 1.89.1 版本之前存在一个缺少授权检查的漏洞，该漏洞允许已认证的低权限用户通过调用 API 读取其本无权访问的 CRM 潜在客户（Lead）记录。该 API 执行原生数据库查询时未触发权限系统，攻击者只需向端点提供已知电话号码，即可绕过标准 API 和用户界面（UI）的访问控制，获取完整的潜在客户详情，从而导致敏感 CRM 数据被未授权披露。

CVSS 6.5 · Medium Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1086 T1201 · Password Policy Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API

Source: CVE Program / CVE List V5

Vulnerability Description

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
frappe	crm	1.0.0 ~ 1.89.1	-

II. Public POCs for CVE-2026-116492

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116492

请登录查看更多情报信息。

Other References for CVE-2026-116492 (3)

https://github.com/frappe/crm/pull/3103 issue-tracking
https://github.com/frappe/crm/releases/tag/v1.89.1 patch
https://www.vulncheck.com/advisories/frappe-crm-before-missing-authorization-via-phone-lookup-api third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116492

Same Patch Batch · frappe · 2026-10-26 · 4 CVEs total

CVE-2026-115717	7.7 HIGH	Frappe Builder before 1.36.1 SSRF via convert_to_webp
CVE-2026-115720	5.0 MEDIUM	Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect
CVE-2026-115718	4.3 MEDIUM	Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

IV. Related Vulnerabilities

Same product: crm

Same vendor: frappe

Same weakness: CWE-862