CVE-2026-111938

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks...

CVE-2026-111938

Frappe CRM versions prior to 1.74.0 are vulnerable to a missing authorization vulnerability (CWE-862). Authenticated Sales Users can modify the call logs of other users by providing arbitrary call_sid values. Specifically, an attacker can access the add_note_to_call_log and add_task_to_call_log e...

EUVD-2026-104313

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks...

CVE-2026-111938 Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks...

CVE-2026-111938 Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks...