CVE-2026-53761: Frappe CRM Auth Bypass Vulnerability

CVE-2026-53761 Overview

CVE-2026-53761 is an authentication bypass vulnerability in Frappe CRM, an open-source customer relationship management platform. The flaw resides in the crm/api component and stems from invitation keys being written to application logs. An attacker with access to those logs can reuse a valid invitation key to bypass authentication controls. The issue affects all Frappe CRM versions prior to 1.73.0 and is fixed in release 1.73.0. The vulnerability is classified under CWE-287: Improper Authentication.

Critical Impact
Successful exploitation allows an unauthenticated network attacker to bypass authentication in Frappe CRM and gain access to CRM data, resulting in a high integrity impact against tenant records.

Affected Products

Frappe CRM versions prior to 1.73.0
Deployments exposing the crm/api endpoints over the network
Environments where application or web server logs are accessible to additional users or systems

Discovery Timeline

2026-09-04 - CVE-2026-53761 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database
Fix released in Frappe CRM v1.73.0 (see GitHub Release v1.73.0 and GitHub Security Advisory GHSA-wqrv-q8m5-qr77)

Technical Details for CVE-2026-53761

Vulnerability Analysis

Frappe CRM issues invitation keys to onboard new users into a CRM workspace. These keys function as authentication material and grant the holder the ability to accept an invitation and establish an authenticated session. In versions prior to 1.73.0, invitation keys handled by the crm/api code path were written into application logs alongside routine request metadata. Any actor able to read those logs can extract the key and replay it against the invitation acceptance flow. The result is authentication bypass without knowledge of a legitimate account password or session token. The maintainers addressed the issue in release 1.73.0 by removing invitation key material from logged output.

Root Cause

The root cause is improper authentication handling combined with sensitive data being written to logs. Invitation keys were treated as ordinary request parameters during logging rather than as authentication secrets requiring redaction. This maps to CWE-287 because the design allowed a secret-based authentication mechanism to be trivially reused by any party with access to log storage.

Attack Vector

The attack is network-based and requires no privileges or user interaction against the CRM instance itself. An attacker who obtains log data — through a misconfigured log aggregator, an over-permissive log reader role, a compromised operator workstation, or a separate log-exposure flaw — parses the recorded invitation key. The attacker then submits the key to the invitation acceptance endpoint under crm/api and completes onboarding as the invited identity. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Refer to the GitHub Security Advisory GHSA-wqrv-q8m5-qr77 for the maintainer's technical description.

Detection Methods for CVE-2026-53761

Indicators of Compromise

Invitation key values or key= query parameters appearing in historical application logs, reverse proxy logs, or SIEM records associated with crm/api routes.
Successful invitation acceptance events originating from IP addresses that differ from the recipient's expected network.
New CRM user accounts created without a corresponding outbound invitation email delivery confirmation.

Detection Strategies

Search log stores for requests to invitation-related paths under crm/api where a key parameter was captured in the log line.
Correlate invitation acceptance events with the source IP and user-agent of the invited user's normal activity, flagging deviations.
Alert on read access to CRM log files or log indices by accounts that are not part of the platform operations group.

Monitoring Recommendations

Ingest Frappe CRM application, web server, and reverse proxy logs into a centralized analytics platform and retain them for post-incident review.
Baseline the volume and geography of invitation acceptance events and alert on statistical outliers.
Monitor privileged role changes and CRM data export activity immediately following any invitation acceptance from an unusual source.

How to Mitigate CVE-2026-53761

Immediate Actions Required

Upgrade Frappe CRM to version 1.73.0 or later on all instances, prioritizing internet-exposed deployments.
Invalidate any outstanding invitation keys issued by vulnerable versions and reissue invitations after the upgrade.
Audit application and infrastructure logs for exposure of invitation keys and rotate any keys that appear in log records.

Patch Information

The vulnerability is fixed in Frappe CRM v1.73.0. Release notes and patch metadata are available in the GitHub Release v1.73.0. Deployment details and the maintainer's advisory are published in the GitHub Security Advisory GHSA-wqrv-q8m5-qr77.

Workarounds

Restrict read access to Frappe CRM log files, log volumes, and downstream log aggregation indices to a minimal set of operator identities.
Configure log scrubbing at the reverse proxy or log shipper to redact key, invitation, and similar query parameters before storage.
Reduce the validity window of outstanding invitations and require administrator approval for invitation acceptance where the workflow supports it.

bash

# Upgrade Frappe CRM using bench to the patched release
bench get-app --branch v1.73.0 https://github.com/frappe/crm
bench --site <site-name> install-app crm
bench --site <site-name> migrate
bench restart