CVE-2026-108734 frappe CVE debrief

Who should care

Defenders responsible for Frappe CRM instances, particularly those with authenticated user access, should assess exposure and prioritize remediation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should also verify Frappe CRM version and implementation of permission checks.

Why it matters

This missing authorization vulnerability in Frappe CRM 1.49.0 through 1.87.0 allows authenticated users to access linked documents without proper permission checks, potentially exposing sensitive information.

• Authenticated users can read linked documents without permission checks
• Potential exposure of sensitive information in linked documents
• Verification of Frappe CRM version and implementation of permission checks are necessary

Technical summary

The crm.api.doc.get_linked_docs_of_document function in Frappe CRM 1.49.0 through 1.87.0 does not perform proper authorization checks, allowing authenticated users to read linked documents without permission. This vulnerability allows unauthorized access to linked documents, potentially exposing sensitive information. Defenders should prioritize verifying and remediating this vulnerability in Frappe CRM instances, particularly those exposed to authenticated users. The vulnerability affects Frappe CRM instances with authenticated user access.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Frappe CRM instances, particularly those exposed to authenticated users.

Recommended defensive actions

• Verify Frappe CRM version and check for exposure
• Restrict access to authenticated users
• Implement permission checks for get_linked_docs_of_document
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Plan vendor-supported updates or mitigations

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in Frappe CRM 1.49.0 through 1.87.0. The vulnerability allows authenticated users to access linked documents without proper permission checks, potentially exposing sensitive information. Defenders should verify Frappe CRM version and implementation of permission checks. The source item provides additional information on the vulnerability, and defenders should review it for further details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.