Live › vulnerability › CVE-2026-111938
Go to dashboardFrappe CRM before 1.74.0 does not check ownership when a Sales User attaches notes or tasks to a call log, so any authenticated Sales User can supply another user's call_sid. The attacker-written notes and tasks then appear on the victim's call logs, leads and deals.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Frappe CRM before 1.74.0 where Sales User accounts can log in and use call logging. The attacker needs a valid Sales User account, so exposure depends on how many people hold that role. Teams on 1.74.0 or later, or without Frappe CRM, can skip it.
No product ranges from the sources yet.
bench version or the app's version field, and compare it with 1.74.01.74.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
This page as .md · .json · in your agent: get_signal("CVE-2026-111938")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.