CVE-2026-116492 Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116492?
CVE-2026-116492 is a high-severity vulnerability in frappe crm, published on 26 Oct 2026.
Official description
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.
Weakness: CWE-862
Which versions are affected by CVE-2026-116492?
How do I fix CVE-2026-116492?
No fix has been published for CVE-2026-116492 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116492 being exploited?
There is no known exploitation of CVE-2026-116492 in the wild and no public exploit code.
Sources
Also known as GHSA-qmcv-7jcv-gffw.