CVE-2026-116492 in Frappe
Summary
by MITRE • 10/26/2026
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified within Frappe CRM versions prior to 1.89.1 represents a critical failure in authorization logic, specifically classified under CWE-269 Improper Privilege Management. This flaw stems from the implementation of the get_contact_by_phone_number API endpoint, which is designed to retrieve contact information based on a provided phone number. While standard application interfaces and most other API endpoints within the Frappe framework correctly enforce role-based access controls through its built-in permission system, this specific integration point bypasses these safeguards entirely by executing raw database queries directly against the backend storage without invoking the necessary authorization checks. This architectural inconsistency creates a significant security gap that allows authenticated users with low-privileged roles to escalate their effective permissions and access sensitive data they are otherwise explicitly denied.
From an operational perspective, this vulnerability enables unauthorized disclosure of personally identifiable information and other sensitive CRM lead records. An attacker who has obtained valid credentials for a standard user account can interact directly with the crm.integrations.api.get_contact_by_phone_number endpoint by supplying any known phone number associated with a lead record in the system. Because the API does not verify whether the requesting user has permission to view that specific record, it returns full details including names, contact information, and potentially other proprietary business data contained within the CRM database. This capability effectively neutralizes the intended access controls of the application, allowing low-privileged users to perform reconnaissance or exfiltrate competitive intelligence by querying phone numbers they may have acquired through social engineering or public sources.
The technical root cause lies in the deviation from secure coding practices where API endpoints should consistently utilize the framework's permission layer before returning data. By performing raw database queries without checking user roles against record-level permissions, the application fails to implement proper object level authorization as defined by CWE-639 Authorization Bypass Through User-Controlled Key. This type of vulnerability is particularly dangerous because it often goes undetected during standard functional testing if testers do not specifically target integration endpoints with privilege escalation scenarios in mind. The attack vector aligns with ATT&CK technique T1078 Valid Accounts, as the exploitation requires initial authentication but leverages a flaw to access resources beyond the assigned user's privileges, falling under the broader category of Privilege Escalation within the lateral movement and collection phases of an adversary's lifecycle.
Mitigation for this vulnerability is straightforward and primarily involves upgrading the Frappe CRM application to version 1.89.1 or later, where the developers have addressed this authorization bypass by ensuring that all API endpoints properly invoke the permission system before returning data. For organizations unable to immediately patch due to compatibility constraints, temporary mitigations include restricting network access to the specific integration endpoint if it is not required for external integrations, or implementing a Web Application Firewall rule to monitor and block anomalous query patterns targeting this API with high-frequency requests from low-privileged accounts. Additionally, developers should conduct a thorough audit of all custom APIs within their Frappe instances to ensure that no other endpoints are similarly bypassing the standard permission checks by using raw database queries instead of the framework's ORM or permission layers. Regular security assessments and code reviews focusing on authorization logic in API implementations are essential to prevent similar vulnerabilities from being introduced in future updates or custom developments.