CVE-2026-108734: Frappe CRM Authorization Bypass Vulnerability

CVE-2026-108734 Overview

CVE-2026-108734 is a missing authorization vulnerability [CWE-862] in Frappe CRM versions 1.49.0 through 1.87.0. The flaw resides in the crm.api.doc.get_linked_docs_of_document API endpoint, which fails to enforce document-level permission checks. Authenticated users can reference leads, deals, comments, or users they lack permission to read and retrieve linked data. Exposed information includes call log phone numbers, deal organizations, and mention notification text. The vulnerability affects confidentiality of CRM data without impacting integrity or availability.

Critical Impact

Any authenticated Frappe CRM user can bypass document access controls and extract sensitive customer data linked to records outside their permission scope.

Affected Products

• Frappe CRM version 1.49.0
• Frappe CRM versions 1.50.0 through 1.86.0
• Frappe CRM version 1.87.0

Discovery Timeline

• 2026-10-11 - CVE-2026-108734 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108734

Vulnerability Analysis

The vulnerability resides in the get_linked_docs_of_document function in crm/api/doc.py. The endpoint accepts a document name and type, then returns documents linked to that reference. The function queries linked records without verifying that the calling user has read permission on the parent document or the linked results. An authenticated attacker crafts requests naming leads, deals, comments, or users outside their permission scope. The API returns linked call log phone numbers, deal organizations, and mention notification text. The data exposure occurs server-side, bypassing standard Frappe document permission enforcement. Review the HackMD Unchecked Read Vulnerability Analysis for full exploitation details.

Root Cause

The root cause is a missing authorization check in the get_linked_docs_of_document handler. The function retrieves linked documents based on user input without invoking Frappe's permission framework (has_permission) on either the referenced document or the returned linked records. See the vulnerable code location in the Frappe CRM repository.

Attack Vector

The attack requires network access and low-privilege authenticated credentials. No user interaction is needed. An attacker submits an authenticated request to the vulnerable API endpoint, supplying the name of a lead, deal, comment, or user they cannot read. The server returns linked document fields including phone numbers from call logs, organization names from deals, and notification text from mentions. The vulnerability permits silent data harvesting across tenant records that should be isolated. Refer to the VulnCheck Advisory for Frappe CRM for the technical write-up.

Detection Methods for CVE-2026-108734

Indicators of Compromise

• Unusual volume of requests to crm.api.doc.get_linked_docs_of_document from a single authenticated session.
• API calls referencing document names belonging to leads, deals, or users outside the caller's assigned territory or role.
• Sequential enumeration patterns targeting document names (e.g., CRM-LEAD-2026-00001, CRM-LEAD-2026-00002).
• Authenticated users accessing linked call log or deal data without corresponding reads on parent records.

Detection Strategies

• Enable Frappe audit logging and monitor requests to the /api/method/crm.api.doc.get_linked_docs_of_document endpoint.
• Correlate API access logs against the user's assigned document permissions to flag out-of-scope reads.
• Alert on authenticated API sessions that request linked documents at rates exceeding normal CRM usage baselines.

Monitoring Recommendations

• Instrument the Frappe application layer to log the invoking user, requested document, and returned linked records.
• Forward CRM web server access logs to a centralized SIEM for correlation with identity and session telemetry.
• Review Frappe permission denial events alongside successful API responses to detect authorization bypass patterns.

How to Mitigate CVE-2026-108734

Immediate Actions Required

• Upgrade Frappe CRM to a version later than 1.87.0 that includes the authorization fix.
• Audit recent access logs for the get_linked_docs_of_document endpoint and investigate anomalous activity.
• Restrict Frappe CRM accounts to the minimum roles required and remove unused authenticated accounts.
• Rotate any customer phone numbers, deal data, or notification content known to have been exposed if a breach is confirmed.

Patch Information

Frappe maintainers address the issue in versions above 1.87.0. Monitor the GitHub Frappe CRM Repository for the fixed release and apply the update across all production and staging deployments.

Workarounds

• Place the Frappe CRM instance behind an authenticated reverse proxy that filters or rate-limits calls to crm.api.doc.get_linked_docs_of_document until patching is complete.
• Temporarily disable or whitelist the vulnerable API endpoint at the web server layer for non-administrative users.
• Reduce exposure by limiting the number of users with authenticated access to the CRM during the remediation window.

# Example nginx configuration to block the vulnerable endpoint until patched
location /api/method/crm.api.doc.get_linked_docs_of_document {
    deny all;
    return 403;
}