Frappe Crm (Frappe) - vulnerabilities (CVEs)

5 CVEs, 3 in the last 30 days, 181 known versions, newest CVE from 2026-10-26. Vendor: Frappe.

CVEs of Frappe Crm

• CVE-2026-116492 - CVSS 7.1 (high), 2026-10-26: Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are…
• CVE-2026-111938 - CVSS 5.3 (medium), 2026-10-19: Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying…
• CVE-2026-111937 - CVSS 5.4 (medium), 2026-10-19: Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records…
• CVE-2025-68928 - CVSS 5.4 (medium), 2025-12-29: Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field,…
• CVE-2025-11461 - CVSS 8.8 (high), 2025-11-26: Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue…