Frappe CRM CVE-2025-68928

Exploitation requires an authenticated CRM account with permission to create or edit a CRM Organization (or Contact) record and populate its 'website' field with an unsanitized URL. The payload only fires when a second user subsequently views that record and actively clicks the website link, which routes an attacker-controlled value (e.g. a javascript: scheme) into window.open() without protocol validation. Limiting factors: valid credentials are needed (PR:L), the attack is not self-triggering and depends on victim interaction (UI:R), and it is confined to versions prior to 1.56.2 - the patch adds a strict http/https allowlist that neutralizes the vector with no configuration change required.

This is a moderate, not urgent, priority. The provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a stored cross-site scripting flaw requiring authentication (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting execution in another user's browser context and only Low confidentiality/integrity impact. No EPSS score, KEV listing, or POC was supplied, so exploitation signals are absent - there is no public exploit identified at time of analysis and no evidence of active exploitation. The source-code evidence clarifies the real mechanism: a 'website' field value is passed to window.open() without protocol validation, so a crafted javascript:-scheme URL executes when another operator clicks the organization's website link; the patch introduces a getSafeWebsiteUrl() http/https allowlist. The signals are internally consistent - authenticated, interaction-gated, limited-impact XSS - pointing to a genuine but lower-tier issue rather than a high-CVSS/low-real-risk outlier or a wormable threat. No conflicting data was observed; the main limitation is simply that exploitation-likelihood telemetry (EPSS/KEV/POC) was not provided.

An authenticated CRM user with permission to create or edit an organization sets the website field to a javascript:-scheme (or other non-http) payload instead of a normal URL. When another user - such as a sales rep or administrator - later opens that organization and clicks the website link, the unsanitized value is handed to window.open(), executing attacker-controlled script in the victim's authenticated session. No public exploit was identified at time of analysis, though the fix commit publicly reveals the vulnerable code path.