CVE-2026-108734 — Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documen…
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7