Live › vulnerability › CVE-2026-116492
Go to dashboardFrappe CRM before 1.89.1 exposes the get_contact_by_phone_number endpoint, which runs raw database queries without the permission checks. An authenticated low-privileged user who knows a phone number can pull full CRM lead details they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams running self-hosted Frappe CRM before 1.89.1 that have low-privileged users with login access. The exposure depends on those users being able to authenticate and knowing a lead's phone number. Sites on a fixed version or without multi-role CRM users can skip it.
No product ranges from the sources yet.
bench version or the app's package metadata) and confirm whether it is below 1.89.1crm.integrations.api.get_contact_by_phone_number is reachable by non-admin accounts on your site1.89.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.
This page as .md · .json · in your agent: get_signal("CVE-2026-116492")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.