Frappe CRM authentication bypass through logged invitation keys

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0.

• Frappe CRM (frappe / crm): The normalized CVE facts list the affected range as < 1.73.0.
• CNA or vendor advisory: Lists affected versions as <v1.72.1 and the patched version as v1.73.0.
• These boundaries conflict. The status of releases from 1.72.1 through versions before 1.73.0 is not resolved by the available evidence.
• For triage, review every deployment < 1.73.0; do not assume that 1.72.1 or any intermediate release is safe without branch-specific confirmation.

The vulnerable Frappe CRM area is crm/api; the supplied description identifies logged invitation keys as the condition enabling the authentication bypass. The vendor advisory states that deployments where user invitations have been issued are exposed and provides a workaround targeting accepted invitation rows whose key field remains populated. Release notes describe the corrective behavior as setting the key to null after acceptance and adding a pending status for invitations. The normalized attack characteristics indicate network reachability, no prior privileges, no user interaction, low complexity, and a required invitation-related condition. The weakness is classified as CWE-287, Improper Authentication. Public material does not establish the exact endpoint, request format, authorization decision, or which specific CRM operations can be reached, so those implementation details remain unknown.

• Reachability: Network.
• Precondition: The deployment must have an invitation-related condition; the advisory specifically identifies deployments where user invitations have been issued.
• Authentication: No prior privileges are required.
• User interaction: None.
• Complexity: Low.
• Known status: The supplied record marks public exploit as false and known exploitation as unset. CISA ADP enrichment records exploitation as none and automatable as no. These statuses are limited to the available records and do not prove that future exploitation will not occur.

The confirmed technical outcome is an authentication bypass that can enable unauthorized integrity changes in Frappe CRM. The structured record states no confidentiality or availability impact, so disclosure of data and service outage should not be treated as established outcomes. The likely organizational consequence is unauthorized modification of CRM data or state in deployments with issued invitations, but the specific affected operations remain undocumented. CISA enrichment characterizes the technical impact as partial.

Organizations using Frappe CRM where user invitations have been issued may face unauthorized changes to CRM state or data. The possible consequence is manipulation of CRM records or invitation-related state, but the available material does not identify the exact business operations that can be performed. The structured record does not state a confidentiality or availability impact, so data disclosure and service interruption should not be assumed. Incident review should prioritize accepted invitations with retained keys and unusual recent changes to CRM integrity.

1. Upgrade to v1.73.0: This is the release identified as patched by the vendor advisory. The release notes describe the fix as setting the key to null after an invitation is accepted and adding a pending invitation status.
2. If an upgrade is not immediately possible, apply the vendor workaround: Manually run a script or SQL command that nullifies or randomizes the key field for every row in tabCRM Invitation whose status is Accepted. The advisory does not provide one canonical command, so do not invent or assume SQL syntax.
3. Review the unresolved boundary: Check deployments from 1.72.1 through versions before 1.73.0 separately because the advisory and normalized record specify different affected ranges.
4. Verify each release branch independently: Do not infer that parallel branches or releases other than the named patched release are protected without supporting evidence.

• Inventory the Frappe CRM version on every deployment and compare it with the version boundaries in affected_summary.
• Identify deployments where user invitations have ever been issued, because the advisory ties exposure to that condition.
• Inspect tabCRM Invitation, focusing on rows with status Accepted, and determine whether the key field still contains a value or has been set to null.
• Review application and web logs around crm/api and invitation flows for unauthenticated requests or unusual CRM changes. This is precautionary monitoring, not a confirmed indicator of compromise.
• Review recent CRM integrity changes, especially on deployments with accepted invitations. The absence of suspicious log evidence does not prove that the deployment is safe.