Executive brief
Frappe CRM is an open-source customer relationship management system used to manage customer interactions and sales processes. A vulnerability in the invitation system allows attackers to bypass authentication using logged invitation keys, potentially granting unauthorized access to CRM data and functionality for any deployment where invitations have been issued.
Technical details
The vulnerability is an authentication bypass flaw in the crm/api endpoint that fails to invalidate invitation keys after they have been accepted. An attacker can reuse logged invitation keys to gain unauthorized access to the system. The vulnerability affects versions prior to 1.73.0 and has been patched in version 1.73.0. As a workaround, administrators can manually nullify or randomize the key field in the tabCRM Invitation table for rows with "Accepted" status. The vulnerability impacts any Frappe CRM deployment where user invitations have been issued.
Affected products
- Frappe CRM prior to 1.73.0
Timeline
- 2026-06-02: disclosed
- 2026-06-03: patched: Version 1.73.0 released
- 2026-09-04: advisory