CVE-2026-116492: Frappe Whitelisted Phone Lookup Missing Permission Checkcve-2026-116492-frappe-whitelisted-phone-lookup-missing-permission-check
Whitelisted HTTP endpoint $FUNC resolves a CRM record from the caller-controlled parameter $PARAM via $LOOKUP and returns the match without enforcing document read permissions. The lookup runs raw query-builder queries that bypass the Frappe permission engine, and @frappe.whitelist() only requires authentication, so any authenticated user can enumerate Leads
