{"id":"CVE-2026-111938","kind":"vulnerability","aliases":["CVE-2026-111938"],"related":[],"title":"Frappe CRM: authenticated Sales Users can alter other users' call logs","description":"Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.","summary":"Frappe CRM before 1.74.0 does not check ownership when a Sales User attaches notes or tasks to a call log, so any authenticated Sales User can supply another user's call_sid. The attacker-written notes and tasks then appear on the victim's call logs, leads and deals.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frappe-crm","package","sales-teams","self-hosted"],"not_affected_if":["no-telephony-call-logging","version-1.74.0-or-later"],"how_to_check":"- Check the installed Frappe CRM version in the bench or app list, for example `bench version` or the app's version field, and compare it with `1.74.0`\n- Review whether the add_note_to_call_log and add_task_to_call_log endpoints are reachable by Sales User accounts","fix":"- Upgrade Frappe CRM to `1.74.0` or later\n- Review notes and tasks on call logs, leads and deals for entries you do not recognise","status":"open","published_at":"2026-10-19T14:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:25:09+00:00","updated_at":"2026-10-25T04:25:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:25:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Frappe CRM to `1.74.0` or later\n- Review notes and tasks on call logs, leads and deals for entries you do not recognise","reach":"internet","title":"Frappe CRM: authenticated Sales Users can alter other users' call logs","impact":"medium","summary":"Frappe CRM before 1.74.0 does not check ownership when a Sales User attaches notes or tasks to a call log, so any authenticated Sales User can supply another user's call_sid. The attacker-written notes and tasks then appear on the victim's call logs, leads and deals.","category":"package","nicknames":[],"who_cares":["frappe-crm","self-hosted","sales-teams"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated users alter other users' call logs, leads and deals.","analyst_note":"","how_to_check":"- Check the installed Frappe CRM version in the bench or app list, for example `bench version` or the app's version field, and compare it with `1.74.0`\n- Review whether the add_note_to_call_log and add_task_to_call_log endpoints are reachable by Sales User accounts","needs_analyst":false,"not_affected_if":["version-1.74.0-or-later","no-telephony-call-logging"],"who_is_affected":"Teams running Frappe CRM before 1.74.0 where Sales User accounts can log in and use call logging. The attacker needs a valid Sales User account, so exposure depends on how many people hold that role. Teams on 1.74.0 or later, or without Frappe CRM, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3348,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111938':14A,17A '-2026':13A,16A '1.74.0':31B,81C 'add':108C,114C 'allow':88C 'alter':7A 'anoth':55B 'appear':68B,129C 'arbitrari':100C 'attach':40B,121C 'attack':62B,104C,123C 'attacker-written':61B,122C 'authent':3A,50B,89C 'author':85C 'call':10A,46B,58B,73B,96C,101C,106C,111C,117C,132C 'check':34B 'contain':82C 'crm':2A,20B,29B,79C 'cve':12A,15A 'deal':77B,136C 'endpoint':119C 'frapp':1A,19B,28B,78C 'frappe-crm':18B 'host':27B 'lead':75B,134C 'log':11A,47B,74B,97C,112C,118C,133C 'miss':84C 'modifi':93C 'note':41B,64B,109C,125C 'ownership':35B 'packag':21B 'sale':4A,23B,38B,51B,90C 'sales-team':22B 'self':26B 'self-host':25B 'sid':59B,102C 'suppli':54B,99C 'task':43B,66B,115C,127C 'team':24B 'user':5A,9A,39B,52B,56B,91C,95C 'valu':103C 'victim':71B,131C 'vulner':86C 'written':63B,124C","nicknames":[],"mitigations":[],"who_affected":"Teams running Frappe CRM before 1.74.0 where Sales User accounts can log in and use call logging. The attacker needs a valid Sales User account, so exposure depends on how many people hold that role. Teams on 1.74.0 or later, or without Frappe CRM, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111938","severity":null,"published_at":"2026-10-19T14:17:01+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}