Frappe CRM CVE-2026-116492

Requires an authenticated low-privileged account (PR:L - e.g., the 'Sales User' role seen in the patch tests) on a Frappe CRM instance running a version before 1.89.1. The attacker must know or guess a target's phone number, then call the crm.integrations.api.get_contact_by_phone_number endpoint; the vulnerable code path resolves matches with raw database queries and does not invoke frappe.has_permission, so normal API/UI access controls are bypassed. Limiting factors: a valid authenticated session is mandatory (not remotely anonymous), each lookup returns only the lead matching one supplied phone number (no bulk dump without phone-number enumeration), the impact is confidentiality-only, and instances patched to v1.89.1 - which filters results to records the user can read - are not affected.

This is a genuine but moderate-priority issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing no user interaction, but PR:L confirms it requires an authenticated low-privileged account - so this is an insider/post-authentication data-exposure flaw, not a remote-unauthenticated breach. Impact is confidentiality-only (VC:H, VI:N, VA:N): an attacker can read CRM Lead records but cannot modify data or affect availability. The vuln.today decision label is 'this_week', consistent with a real-but-not-urgent priority. No CISA KEV listing and no public exploit identified at time of analysis - the only code artifacts are the vendor patch (PR #3103) and release v1.89.1, which is a fix, not a weaponized PoC. EPSS data is MISSING from the input, so probability-of-exploitation cannot be quantified here. The practical risk is bounded by two factors the raw 7.1 score understates: the attacker needs a valid authenticated session, and each query returns only the lead matching one supplied phone number, so mass harvesting requires enumerating known phone numbers. Net: confirmed broken-access-control (CWE-862) with a vendor patch available, warranting prompt patching in multi-tenant or large-user CRM deployments but not emergency escalation.

A low-privileged user (e.g., a Sales User role) with a legitimate Frappe CRM account calls the crm.integrations.api.get_contact_by_phone_number endpoint, supplying a phone number belonging to a lead owned by another user. Because the endpoint ran raw database queries without calling frappe.has_permission, it returns the full lead details that the standard UI and API would have blocked. No public exploit code was identified; the patch (PR #3103) adds a per-record read-permission filter.