Frappe CRM CVE-2026-111938

Requires a valid authenticated session with the Sales User role in Frappe CRM versions before 1.74.0; the attacker must supply call_sid values belonging to other users (obtainable by enumeration/guessing) to the add_note_to_call_log and add_task_to_call_log endpoints, which in vulnerable versions perform no frappe.has_permission('CRM Call Log', 'write', ...) check before writing. Limiting factors: exploitation is NOT possible unauthenticated or by anonymous users (PR:L), impact is confined to integrity of call-log/lead/deal annotations (no data disclosure or outage), and the issue is fully remediated by upgrading to v1.74.0 which adds the ownership/permission check.

This is a medium-severity integrity-only issue, not a top-tier priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and is internally consistent with the description: exploitation is network-based and low-complexity but requires an authenticated account (PR:L) holding the Sales User role, and impact is limited to low integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect - matching a missing-authorization (CWE-862) flaw that lets a user write notes/tasks onto records they do not own. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit is referenced, so there is no signal of active or probable exploitation. The absence of these signals combined with the authenticated-only, integrity-only nature strongly suggests this is a high-value-insider / data-tampering concern rather than a mass-exploitation threat. One terminology mismatch to verify: the input Tags and the scenario describe an 'Authentication Bypass', but the CWE (862) and description describe a missing authorization / IDOR among already-authenticated users - these are distinct and the authorization framing is the accurate one.

A low-privileged but authenticated Sales User in a shared Frappe CRM tenant enumerates or guesses the call_sid values belonging to colleagues and invokes the add_note_to_call_log and add_task_to_call_log endpoints with those IDs. The attacker-written notes and tasks then surface on victims' call logs, leads, and deals, enabling misinformation, social-engineering pretexts, or sabotage of another rep's pipeline. No public exploit code is referenced, and the network/low-complexity vector means a crafted authenticated API call is all that is required.