---
id: "CVE-2026-116492"
kind: "vulnerability"
aliases: ["CVE-2026-116492"]
title: "Frappe CRM: low-privileged users can read restricted lead records by phone"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frappe", "frappe-crm", "package", "self-hosted"]
not_affected_if: ["patched-version", "single-role-deployment"]
published_at: "2026-10-26T14:16:37+00:00"
first_seen_at: "2026-10-26T14:30:37+00:00"
updated_at: "2026-10-26T14:32:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116492", "first_seen_at": "2026-10-26T14:30:37+00:00"}]
---

# Frappe CRM: low-privileged users can read restricted lead records by phone

Frappe CRM before 1.89.1 exposes the get_contact_by_phone_number endpoint, which runs raw database queries without the permission checks. An authenticated low-privileged user who knows a phone number can pull full CRM lead details they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Frappe CRM version (for example `bench version` or the app's package metadata) and confirm whether it is below `1.89.1`
- Confirm whether the endpoint `crm.integrations.api.get_contact_by_phone_number` is reachable by non-admin accounts on your site

## Fix

- Upgrade Frappe CRM to `1.89.1` or later
- Until upgraded, restrict access to the integrations API for low-privileged roles unknown

## Timeline

- 2026-10-26T14:30:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116492

## From the sources

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_