Frappe CRM EUVD-2026-96900

Requires a valid authenticated Frappe CRM session at any privilege level - the attacker must be able to call the REST/RPC endpoint crm.api.doc.get_linked_docs_of_document and supply the name of a target lead, deal, comment, or user document. No special non-default configuration or user interaction is needed; the missing permission check is in the standard code path. Exploitation is LIMITED by the authentication requirement (PR:L, so a login is mandatory - self-service signup or a low-trust internal account suffices) and by the narrow data scope: only linked-document metadata (call-log phone numbers, deal organizations, mention notification text) is exposed, with no write, modification, or denial-of-service capability. Affects Frappe CRM versions 1.49.0 through 1.87.0.

This is a genuine but low-to-moderate priority information-disclosure flaw, not a false-alarm high-CVSS issue - and in fact it is scored modestly (5.3) to begin with. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) consistently describes a network-reachable, low-complexity bug that REQUIRES an authenticated low-privilege account (PR:L) and yields only limited confidentiality impact (VC:L) with zero integrity or availability impact - matching the description's claim that attackers merely read linked data (call-log phone numbers, deal organizations, mention text) they should not see. All signals align in the same direction: there is no CISA KEV listing, no confirmed public exploit code flag, and no EPSS probability supplied in the input, so exploitation likelihood cannot be quantified from the data provided and should be treated as unmeasured rather than low. The limiting factors (valid authentication needed, only low-sensitivity CRM metadata exposed, no write capability) substantially cap real-world severity; the realistic risk is a malicious or compromised internal CRM user harvesting cross-tenant/cross-permission records, not mass internet exploitation. No key signals conflict, but note the absent EPSS and the fact that active-exploitation status is unconfirmed.

A low-privileged but authenticated Frappe CRM user (for example a limited sales rep or a self-registered account) calls the crm.api.doc.get_linked_docs_of_document endpoint, supplying the name of a lead, deal, comment, or user record they have no permission to view. Because the endpoint omits a permission check, the server returns the linked documents, letting the attacker harvest call-log phone numbers, the organizations tied to deals, and the text of mention notifications. A technical write-up describing the flaw is published on HackMD, but no verified weaponized exploit code is confirmed in the provided data.