An authentication bypass vulnerability in Frappe CRM versions prior to 1.73.0 allows unauthenticated attackers to potentially compromise system integrity.

This is an improper authentication vulnerability (CWE-287) located in the crm/api endpoint, where an attacker can bypass security controls via logged invitation keys. The vulnerability permits unauthenticated interaction with specific API functions.

Successful exploitation of this flaw allows an attacker to bypass authentication mechanisms, leading to unauthorized actions within the CRM system. Given the CVSS score of 8.2, this represents a high-severity risk that could result in the compromise of sensitive customer data or unauthorized modification of business records.

Immediate Action: Update Frappe CRM to version 1.73.0 or later immediately to incorporate the security fix.

Proactive Monitoring: Monitor API access logs for unusual patterns or spikes in requests to the crm/api endpoint, particularly those involving invitation keys.

Compensating Controls: Implement strict rate limiting and IP allowlisting on the API gateway to restrict access to the vulnerable endpoint while the update is being staged.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

The authentication bypass in Frappe CRM poses a significant risk to organizational data integrity. Administrators must prioritize updating the software to version 1.73.0 to close the vulnerability. Delaying this update leaves the application exposed to unauthorized access, and immediate remediation is strongly advised.