Frappe CRM CVE-2026-53761

Exploitation requires the attacker to first obtain a valid invitation key that was previously issued by the Frappe CRM application. These keys were logged by the application, so an attacker with read access to application logs - or the ability to intercept the original invitation email/link - can extract the key. The key remains valid indefinitely in unpatched versions because it is never set to null after acceptance. Limiting factors: the attacker cannot generate or brute-force a key without prior access to a log source or network interception point; exploitation is bounded to the CRM's invitation user pool (only users who were sent invitations have associated keys); and the impact is scoped to CRM data integrity with no confidentiality or availability impact confirmed by the CVSS vector.

The CVSS 4.0 score of 8.2 reflects High integrity impact with no confidentiality or availability consequence, which is consistent with an authentication bypass granting write-level access. The AT:P metric is the critical limiting factor: exploitation is not opportunistic; the attacker must possess a specific, previously-issued invitation key. This reduces real-world risk relative to the raw score. EPSS data was not provided, and no KEV listing or POC code has been identified, further lowering short-term exploitation probability. The integrity impact is genuine - a successful bypass allows an attacker to act as the invited user within the CRM, potentially manipulating leads, deals, and contact data. For organizations relying on Frappe CRM in sales workflows, this represents a meaningful insider-threat or log-exposure risk, but not a broad opportunistic attack surface.

An attacker with read access to Frappe CRM application logs extracts an accepted invitation key belonging to a legitimate user. Using this key against the crm/api endpoint, the attacker authenticates as that user without knowing their password, then modifies or exfiltrates CRM data such as lead records and deal stages. No public exploit code has been identified, but the technique requires only a standard HTTP request once the key is obtained.