CVE-2026-53761: falha de alta gravidade em frappe crm
Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.6%
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
frappe · crmCVEs relacionadas — frappe crm
No mesmo produto, das mais perigosas para as menos.
CVE-2026-111938MEDIUMFrappe CRM before 1.74.0 Missing Authorization via add_note_to_call_logEPSS 0.3%CVE-2026-108734MEDIUMFrappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_documentEPSS 0.3%CVE-2026-116492HIGHFrappe CRM before 1.89.1 Missing Authorization via Phone Lookup APIEPSS 0.2%CVE-2026-111937MEDIUMFrappe CRM before 1.81.2 Missing Authorization on CRM Notification RecordsEPSS 0.2%CVE-2025-68928MEDIUMFrappe CRM vulnerable to authenticated XSS via website fieldEPSS 0.2%