CVE-2026-111938mediumCWE-862

CVE-2026-111938: falha de média gravidade em frappe crm

Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Publicada em

Seguir esta CVE+ Monitorar crm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
frappe · crm
CVEs relacionadas — frappe crm

No mesmo produto, das mais perigosas para as menos.

CVE-2026-53761HIGHFrappe CRM: Authentication Bypass via Logged Invitation Keys in crm/apiEPSS 0.6%CVE-2026-108734MEDIUMFrappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_documentEPSS 0.3%CVE-2026-116492HIGHFrappe CRM before 1.89.1 Missing Authorization via Phone Lookup APIEPSS 0.2%CVE-2026-111937MEDIUMFrappe CRM before 1.81.2 Missing Authorization on CRM Notification RecordsEPSS 0.2%CVE-2025-68928MEDIUMFrappe CRM vulnerable to authenticated XSS via website fieldEPSS 0.2%