VYPR
Vypr IntelligenceAI-generatedOct 22, 2026· 7 CVEs

Frappe Ecosystem: High SQLi & Multiple Auth Bypass Flaws Disclosed Together

Seven vulnerabilities, including a high-severity SQL injection and multiple authorization bypasses, were disclosed across Frappe Framework, Helpdesk, CRM, and Chamilo LMS between October 19-22, 2026.

Key findings

  • High-severity blind SQL injection in Frappe Framework (CVE-2026-114664) patched in v16.33.0.
  • Three medium-severity authorization bypass flaws in Frappe Helpdesk and CRM disclosed together.
  • Frappe Helpdesk (pre-1.26.0) allows authenticated user impersonation for phishing ticket creation.
  • Frappe CRM (pre-1.74.0/1.81.2) allows modification of call logs and access to unauthorized notifications.
  • Three medium-severity authorization issues in Chamilo LMS pre-releases also disclosed in the batch.
  • Patches are available for all disclosed Frappe and Chamilo LMS vulnerabilities.

On October 22, 2026, a batch of seven vulnerabilities was disclosed across Frappe's ecosystem, with the earliest disclosures occurring on October 19, 2026. The vulnerabilities, ranging in severity from medium to high, primarily stem from authorization bypass and missing access control flaws within Frappe Framework, Frappe Helpdesk, and Frappe CRM. These issues collectively allow authenticated and, in some cases, unauthenticated attackers to gain unauthorized access to sensitive data, impersonate other users, and modify critical records. The most severe vulnerability, CVE-2026-114664, is a blind SQL injection flaw in Frappe Framework.

Blind SQL Injection in Frappe Framework

The highest severity vulnerability disclosed is CVE-2026-114664, a blind SQL injection flaw affecting Frappe Framework versions prior to 16.33.0. This vulnerability exists in the frappe.desk.doctype.event.event.get_events method, which fails to properly sanitize user-supplied input before incorporating it into SQL queries. Attackers can exploit this by sending crafted input to the get_events method, allowing them to infer data from application queries through the timing or content of the responses.

Authorization Bypass in Frappe Helpdesk and CRM

Three medium-severity vulnerabilities were disclosed in Frappe Helpdesk and CRM applications, as detailed in related coverage from Vypr Intelligence.

  • **CVE-2026-111939** in Frappe Helpdesk (versions before 1.26.0) allows authenticated portal users to impersonate other customers by manipulating the raised_by parameter when creating tickets via the hd_ticket.api.new endpoint. This could lead to phishing attacks within a customer's portal.
  • **CVE-2026-111938** in Frappe CRM (versions before 1.74.0) permits authenticated Sales Users to modify other users' call logs. By exploiting the add_note_to_call_log and add_task_to_call_log endpoints with arbitrary call_sid values, attackers can attach malicious notes and tasks to other users' call logs.
  • **CVE-2026-111937** in Frappe CRM (versions before 1.81.2) involves a missing authorization vulnerability that grants authenticated Sales Users access to other users' CRM Notification records. Attackers can query frappe.client endpoints or use the mark_as_read function with another user's identifier to read or modify notifications.

Missing Authorization in Chamilo LMS Pre-releases

While the primary focus is on Frappe, the batch also includes three vulnerabilities affecting Chamilo LMS pre-release versions (2.0.0-alpha.1 through 2.0.0-RC.3). These issues, all rated medium severity, stem from missing authorization checks:

  • **CVE-2026-114390** exposes user names and certificates through legacy AJAX handlers under public/main/inc/ajax/. Unauthenticated or low-privileged users can access actions like get_users_by_group_course and user_by_all_roles.
  • **CVE-2026-114389**, affecting the AiController::openAnswerGrade functionality, allows any authenticated user to view AI grading results for other students' exam attempts by enumerating exeId and questionId values.
  • **CVE-2026-114388** in the GradebookController permits unauthenticated users to modify gradebook certificates by requesting the set_default_certificate endpoint with arbitrary course and document IDs.

Response and Impact

The vulnerabilities in Frappe Framework were addressed in version 16.33.0. Frappe Helpdesk was patched in versions prior to 1.26.0, and Frappe CRM received fixes in versions prior to 1.74.0 and 1.81.2. The Chamilo LMS vulnerabilities were patched in versions prior to 2.0.0-RC.3.

These disclosures highlight the importance of rigorous access control and input validation in web applications. Users of Frappe Framework, Helpdesk, and CRM are strongly advised to update to the patched versions to mitigate the risks of data breaches, unauthorized access, and impersonation. The presence of a blind SQL injection vulnerability, even in a less severe context, underscores the ongoing threat posed by injection attacks. ,cve_ids:[

AI-written article. Grounded in 7 CVE records listed below.
Frappe Ecosystem: High SQLi & Multiple Auth Bypass Flaws Disclosed Together · VYPR