CVE-2026-108734 in Frappe
Summary
by MITRE • 10/11/2026
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the Frappe CRM framework, specifically affecting versions 1.49.0 through 1.87.0 in the API endpoint responsible for retrieving linked documents associated with a primary document. This vulnerability is classified as an Insecure Direct Object Reference (IDOR), which corresponds to CWE-639 in the Common Weakness Enumeration taxonomy. The core technical deficiency lies in the absence of proper authorization checks within the crm.api.doc.get_linked_docs_of_document function. While the application correctly authenticates users, it fails to verify whether the authenticated user possesses the necessary permissions to access the specific linked resources being requested. This architectural oversight allows an attacker who has valid credentials for any level of access to manipulate input parameters and request data associated with objects they are not authorized to view.
The operational impact of this vulnerability is significant due to the sensitive nature of the data exposed through linked documents in a CRM system. By exploiting this flaw, an authenticated user can enumerate and retrieve private information from leads, deals, comments, or users that would otherwise be restricted by role-based access controls. Specifically, attackers can extract phone numbers contained within call logs associated with unauthorized leads or deals, thereby compromising customer privacy and potentially facilitating social engineering attacks. Furthermore, the vulnerability allows for the disclosure of organizational details linked to specific deals, which may reveal proprietary business relationships or strategic targets. Additionally, mention notification text from comments on restricted documents becomes accessible, exposing internal communications that were intended only for authorized personnel within those specific project teams or departments.
This type of access control bypass aligns with MITRE ATT&CK technique T1078, specifically the Valid Accounts sub-technique where attackers leverage existing credentials to move laterally and exfiltrate data without triggering typical intrusion detection systems associated with unauthorized login attempts. The ability to read linked documents effectively expands the attack surface beyond direct object manipulation into related entities that may have stricter security policies. For instance, while a user might not be able to open a specific deal record due to privacy settings, they can still access the call logs and contact details tied to that deal through this API endpoint. This indirect data leakage undermines the integrity of the organization's data governance model and violates principles of least privilege essential for secure software design.
To mitigate this vulnerability, immediate patching is required by upgrading the Frappe CRM installation to a version newer than 1.87.0 where these authorization checks have been implemented. In environments where an upgrade is not immediately feasible, administrators should implement strict input validation and ensure that every API endpoint performs explicit permission verification against the current user's role and access rights before returning any data linked to other objects. It is also advisable to review all custom integrations or scripts using this API to ensure they adhere to proper security protocols. Regular security audits focusing on object-level authorization logic are recommended to prevent similar IDOR vulnerabilities in future development cycles, ensuring that access control decisions are made consistently across both direct and indirect data retrieval operations.