CVE-2026-111938 in Frappe
Summary
by MITRE • 10/19/2026
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Frappe CRM versions prior to 1.74.0 represents a critical failure in server-side access control mechanisms, specifically classified under CWE-285 Improper Authorization. This flaw allows authenticated users with the Sales User role to bypass intended security boundaries by manipulating input parameters that are not adequately validated against the current user's permissions or ownership context. The core technical issue lies in the application logic governing call log management endpoints, where the system fails to verify whether the caller_sid provided in the request actually belongs to the requesting authenticated session. Instead of enforcing strict object-level access controls, the backend processes requests based solely on the presence of a valid authentication token and the user's general role privileges, ignoring the ownership relationship between the data record and the actor initiating the modification.
By exploiting this missing authorization flaw, an attacker can target arbitrary call logs by supplying maliciously crafted call_sid values in HTTP POST requests directed at specific API endpoints such as add_note_to_call_log and add_task_to_call_log. These endpoints are designed to append contextual information like notes or tasks to existing communication records within the CRM system. Because the server does not validate that the specified call log entry is associated with a lead, deal, or contact owned by or accessible to the authenticated user, it blindly accepts the input and updates the targeted record. This lack of object-level permission checking enables an adversary to inject false information into other users' records without any additional authentication steps or privilege escalation beyond basic login credentials.
The operational impact of this vulnerability extends beyond simple data integrity issues, as it facilitates a form of social engineering within the internal workflow of the organization. Attackers can plant deceptive notes and tasks on victims' call logs that subsequently appear in their associated leads and deals. This manipulation can mislead sales representatives into making decisions based on fabricated history, potentially causing financial loss or reputational damage to both the individual employee and the broader organization. Furthermore, this activity may serve as a precursor to more sophisticated attacks by eroding trust in system data integrity, which is fundamental for effective customer relationship management operations. The ability to alter historical records undetected complicates forensic analysis and audit trails, making it difficult for administrators to distinguish between legitimate user actions and malicious tampering.
From an offensive security perspective, this vulnerability aligns with the MITRE ATT&CK technique T1078 Valid Accounts, as exploitation requires valid authentication credentials, but leverages a flaw in how those accounts are authorized to interact with specific resources rather than gaining unauthorized access through credential theft alone. It also relates to CWE-639 Authorization Bypass Through User-Controlled Key, where the key used for authorization (the call_sid) is directly controlled by the attacker and not properly validated against session context. To mitigate this risk, organizations must upgrade Frappe CRM to version 1.74.0 or later, which addresses these access control deficiencies. In environments where immediate patching is not feasible, implementing a Web Application Firewall with rules that enforce strict validation of resource ownership on API endpoints can provide temporary protection. Additionally, developers should review all CRUD operations involving user-specific data to ensure that every request includes server-side verification confirming the authenticated user has explicit permission to modify the specific instance being targeted.