PT-2026-117400

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call sid values. Attackers can call the add note to call log and add task to call log endpoints to attach attacker-written notes an...