CVE-2026-116492 frappe CVE debrief

Who should care

Defenders responsible for Frappe CRM deployments, especially those with low-privileged user accounts, should assess exposure and prioritize remediation. This includes verifying and restricting access to the get_contact_by_phone_number API, monitoring for unauthorized access attempts, and applying patch 1.89.1 or later to Frappe CRM deployments. Security teams and vulnerability management teams should review the vulnerability details and plan for mitigation

Why it matters

CVE-2026-116492 is a missing authorization vulnerability in Frappe CRM app versions before 1.89.1. Authenticated low-privileged users can query the get_contact_by_phone_number API to read CRM Lead records they are not permitted to access, resulting in unauthorized disclosure of sensitive CRM data. Defenders should prioritize verifying and remediating this vulnerability in Frappe CRM deployments, especially for systems with low-privileged user accounts.

• Verify and restrict access to the get_contact_by_phone_number API
• Monitor for unauthorized access attempts to CRM Lead records
• Apply patch 1.89.1 or later to Frappe CRM deployments

Technical summary

The Frappe CRM app before version 1.89.1 contains a missing authorization vulnerability in the get_contact_by_phone_number API. This allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the API with a known phone number. The vulnerability results in unauthorized disclosure of sensitive CRM data. Defenders should prioritize verifying and remediating this vulnerability in Frappe CRM deployments, especially for systems with low-privileged user accounts. The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.1 and HIGH severity.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Frappe CRM deployments, especially for systems with low-privileged user accounts.

Recommended defensive actions

• Verify Frappe CRM version and apply patch 1.89.1 or later
• Restrict access to the get_contact_by_phone_number API
• Monitor for unauthorized access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.1 and HIGH severity. The vulnerability allows authenticated low-privileged users to read CRM Lead records they are not permitted to access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.