CVE-2026-53761 in Frappe
Summary
by MITRE • 09/04/2026
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/06/2026
The Frappe framework serves as a popular open-source web application platform that powers various customer relationship management and enterprise resource planning tools. Within the specific context of Frappe CRM, versions prior to release 1.73.0 contained a critical authentication bypass vulnerability located within the crm/api module. This flaw stems from an improper handling of invitation keys during the user onboarding or account activation process. Specifically, the system failed to adequately validate whether these invitation tokens had already been consumed or were still valid in their intended state before granting access privileges.
The technical root cause involves a logic error where the application accepts and processes logged invitation keys without sufficient checks against reuse or expiration states that are typically enforced during standard authentication flows. An attacker who obtains a previously used, expired, or otherwise invalid invitation key can exploit this oversight to bypass the expected authentication mechanisms. By submitting these stale credentials through the API endpoint, the system erroneously grants access to protected resources or user accounts without requiring valid session tokens or multi-factor verification steps that would normally be mandatory for such actions.
From an operational perspective, this vulnerability poses a significant risk to data integrity and confidentiality within organizations deploying Frappe CRM. Successful exploitation allows unauthorized individuals to gain entry into customer databases, potentially leading to the exposure of sensitive personal information, financial records, and proprietary business strategies associated with client profiles. The ability to bypass authentication via API endpoints also facilitates automated attacks at scale, as malicious actors can script requests against multiple invitation keys without triggering typical rate-limiting or anomaly detection systems designed for standard login pages.
This vulnerability aligns closely with CWE-287, which describes Improper Authentication, and specifically relates to the failure to properly validate credentials before granting access. In terms of attack vector classification under MITRE ATT&CK, this behavior corresponds to T1078 Valid Accounts, where adversaries use legitimate account information obtained through various means to maintain persistence or escalate privileges without triggering alarms associated with brute-force attempts. The API-based nature of the exploit also touches upon aspects of T1190 Exploit Public-Facing Application, as it leverages a publicly accessible interface for unauthorized access.
To mitigate this risk, organizations must immediately upgrade their Frappe CRM instances to version 1.73.0 or later, where the logic governing invitation key validation has been corrected to ensure that keys are checked against their current status and usage history before granting any permissions. For environments unable to patch immediately due to dependency constraints, implementing a Web Application Firewall rule set can help detect anomalous patterns of API requests involving repeated use of similar token structures or high volumes of failed authentication attempts associated with invitation endpoints. Additionally, auditing logs for unusual access patterns from IP addresses known to be outside normal operational ranges provides an additional layer of defense against exploitation while the underlying code remains vulnerable.