Frappe Helpdesk & CRM: Three Authorization Bypass Flaws Disclosed Together
Key findings • Three medium-severity authorization vulnerabilities disclosed in Frappe Helpdesk and CRM on October 19, 2026. • CVE-2026-111939 allows impersonation and phishing ticket creatio…
Key findings
- Three medium-severity authorization vulnerabilities disclosed in Frappe Helpdesk and CRM on October 19, 2026.
- CVE-2026-111939 allows impersonation and phishing ticket creation in Helpdesk.
- CVE-2026-111938 and CVE-2026-111937 permit unauthorized access and modification of call logs and notifications in CRM.
- Patched versions include Helpdesk before 1.26.0 and CRM before 1.74.0/1.81.2.
On October 19, 2026, three medium-severity vulnerabilities were disclosed in Frappe's Helpdesk and CRM applications. These vulnerabilities, all stemming from authorization bypass or missing authorization flaws, were patched in versions prior to Helpdesk 1.26.0, CRM 1.74.0, and CRM 1.81.2. The disclosures highlight potential risks for authenticated users within these Frappe applications, allowing for unauthorized access and manipulation of data.
CVE-2026-111939, affecting Frappe Helpdesk before version 1.26.0, is an authorization bypass vulnerability. Authenticated portal users can exploit this by supplying a raised_by value to the hd_ticket.api.new endpoint. This allows them to create tickets impersonating other customers, potentially planting phishing tickets in a victim's portal or reading sensitive information.
Two vulnerabilities were found in Frappe CRM. CVE-2026-111938, present in versions before 1.74.0, is a missing authorization vulnerability. Authenticated Sales Users can modify other users' call logs by providing arbitrary call_sid values to the add_note_to_call_log and add_task_to_call_log endpoints. This enables attackers to attach their own notes and tasks, which then appear on the victim's call logs.
The second CRM vulnerability, CVE-2026-111937, affects Frappe CRM before version 1.81.2. This is also a missing authorization vulnerability, allowing authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can exploit this by querying frappe.client endpoints with specific filters on to_user or by calling mark_as_read with another user's argument, enabling them to read or mark notifications as read for other users.
All three vulnerabilities were addressed in subsequent updates. Users of Frappe Helpdesk should ensure they are on version 1.26.0 or later, while Frappe CRM users should be on version 1.74.0 or 1.81.2 or later, depending on the specific component. These patches are crucial for preventing unauthorized access and data manipulation within the Helpdesk and CRM systems.
The coordinated disclosure of these three medium-severity authorization flaws underscores the importance of robust access control mechanisms in multi-tenant applications. Users are advised to update their Frappe Helpdesk and CRM instances to the patched versions to mitigate these risks. Further vigilance regarding application security updates is recommended.