CVE-2026-116492

The Frappe CRM app version prior to 1.89.1 is vulnerable to a missing authorization issue (CWE-862). The crm.integrations.api.get_contact_by_phone_number endpoint performs raw database queries without invoking the application's permission system. This allows authenticated low-privileged users to ...

EUVD-2026-109789

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the getcontactbyphonenumber API, which performs raw database queries without invoking the permission...

CVE-2026-96903

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...

EUVD-2026-104801

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...