Description
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
frappe crm
Default version status: unaffected
0 to < 1.74.0affected
pkg:github/frappe/crmReferences
- https://github.com/frappe/crm/security/advisories/GHSA-843p-qp2f-p2v8 ↗
- https://github.com/frappe/crm/commit/7872f4d178bd9338dba2eb4fc4808f4060914be6 ↗
- https://github.com/frappe/crm/commit/e30df91094033d8583a72e429726ba7bebc1534f ↗
- https://github.com/frappe/crm/releases/tag/v1.74.0 ↗
- https://github.com/frappe/crm/blob/v1.73.2/crm/integrations/api.py ↗
- https://www.vulncheck.com/advisories/frappe-crm-before-1.74.0-missing-authorization-via-add-note-to-call-log ↗