CVE-2026-108734

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108734
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108734.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108734
Published
2026-10-11T12:19:41Z
Modified
2026-10-28T02:30:56Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
Details

Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108734.json"
}
References

Affected packages

Git / github.com/frappe/crm

Affected ranges

Type
GIT
Repo
https://github.com/frappe/crm
Events
Introduced
7870748b417caa92e5d3de105d8ddeb28c495842
Last Affected
0d3910b456ef4fb913e77b29db011b3debc4f778
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.49.0"
                },
                {
                    "last_affected": "1.87.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "1.49.0"
                },
                {
                    "last_affected": "1.87.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

Other
assets-main
v1.*
v1.49.0
v1.49.1
v1.50.0
v1.50.1
v1.50.2
v1.51.0
v1.51.1
v1.52.0
v1.52.1
v1.52.10
v1.52.11
v1.52.2
v1.52.3
v1.52.4
v1.52.5
v1.52.6
v1.52.7
v1.52.8
v1.52.9
v1.53.0
v1.53.1
v1.54.0
v1.55.0
v1.56.0
v1.56.1
v1.56.2
v1.56.3
v1.56.4
v1.56.5
v1.56.6
v1.57.0
v1.57.1
v1.57.10
v1.57.11
v1.57.2
v1.57.3
v1.57.4
v1.57.5
v1.57.6
v1.57.7
v1.57.8
v1.57.9
v1.58.0
v1.58.1
v1.58.2
v1.58.3
v1.58.4
v1.58.5
v1.59.0
v1.59.1
v1.59.2
v1.59.3
v1.60.0
v1.60.1
v1.60.2
v1.60.3
v1.61.0
v1.61.1
v1.61.2
v1.61.3
v1.62.0
v1.62.1
v1.62.2
v1.62.3
v1.62.4
v1.62.5
v1.62.6
v1.63.0
v1.63.1
v1.64.0
v1.65.0
v1.66.0
v1.66.1
v1.66.2
v1.67.0
v1.67.1
v1.68.0
v1.69.0
v1.69.1
v1.70.0
v1.71.0
v1.71.1
v1.71.2
v1.71.3
v1.71.4
v1.71.5
v1.71.6
v1.72.0
v1.73.0
v1.73.1
v1.73.2
v1.74.0
v1.74.1
v1.75.0
v1.76.0
v1.77.0
v1.77.1
v1.77.2
v1.77.3
v1.78.0
v1.78.1
v1.78.2
v1.79.0
v1.79.1
v1.80.0
v1.81.0
v1.81.1
v1.81.2
v1.82.0
v1.83.0
v1.84.0
v1.85.0
v1.85.1
v1.86.0
v1.87.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108734.json"