CVE-2026-108734

EUVD-2026-96900
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.16%
Common Weakness Enumeration
References
https://github.com/frappe/crm
https://github.com/frappe/crm/blob/0d3910b456ef4fb913e77b29db011b3debc4f778/crm/api/doc.py#L684-L725
https://hackmd.io/@haind03/frappe-crm-linked-docs-unchecked-read-20261010
https://www.vulncheck.com/advisories/frappe-crm-1.49.0-through-1.87.0-missing-authorization-via-get-linked-docs-of-document