CVE-2026-53761

Frappe CRM, an open-source customer relationship management tool, contains an authentication bypass (CWE-287) in its crm/api endpoints in all versions before 1.73.0, caused by invitation keys being written to logs where they can be recovered. An attacker who obtains such a logged invitation key can replay it against crm/api to authenticate without valid credentials; no privileges or user interaction are required, although the attack is conditional on the key having been logged (CVSS 4.0 attack requirements: present). A successful attacker gains authenticated API access with a high integrity impact (CVSS 4.0 score 8.2 High), meaning they can create or modify CRM data as the invited user. Any deployment running Frappe CRM earlier than 1.73.0, whether self-hosted or hosted, is affected. No public proof-of-concept exists, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3%, so no exploitation is currently known.

What to do: Upgrade Frappe CRM to version 1.73.0 or later. Until patched, restrict access to crm/api, limit who can read application and server logs, and rotate any invitation keys that may have been captured in logs; also verify that log storage or log-forwarding destinations are not broadly accessible.