{"schema":"threatline.record/2","record":{"id":"CVE-2026-116492","aliases":[],"summary":"Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API","details":"Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.","categories":["Unclassified"],"product":"crm","vendor":"frappe","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116492","source_modified_at":"2026-10-26T12:21:46.284Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"crm","vendor":"frappe","versions":[{"status":"affected","version":"1.0.0","versionType":"semver","lessThan":"1.89.1"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116492","source_modified_at":"2026-10-26T12:21:46.284Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"crm","ecosystem":null},"version":"1.89.1","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T12:21:46.284Z","modified_at":"2026-10-26T12:21:46.284Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116492","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T12:21:46.284Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/frappe/crm/pull/3103","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/frappe/crm/releases/tag/v1.89.1","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/frappe-crm-before-missing-authorization-via-phone-lookup-api","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T12:21:46.284Z","content_hash":"7ebc75db715f205ba39f17bedd0c5cf05c0d87abbb3e30b863e46f02c150618e"}}