Quick answers
- Is CVE-2026-116492 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116492 being exploited in the wild.
- How severe is CVE-2026-116492?
- Medium severity, with a CVSS score of 6.5, published 26 October 2026.
- Which products and versions are affected?
- Frappe Crm before 1.89.1.
- Is there a fix for CVE-2026-116492?
- Yes: fixed in 1.89.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116492 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-116492?
- Check whether you run Frappe Crm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.89.1
Technical details
The get_contact_by_phone_number API endpoint performs raw database queries without invoking the permission system, allowing authenticated low-privileged users to bypass CRM access controls. An attacker supplies a known phone number to retrieve full lead details that are otherwise blocked by standard API and UI access controls. The vulnerability was fixed in version 1.89.1 by splitting phone lookup logic to use separate server-side helpers with proper authorization.
Affected products
- Frappe CRM before 1.89.1
Timeline
- 2026-10-26: disclosed
- 2026-10-23: patched