The vulnerability occurs because the get_contact_by_phone_number API performs a raw database lookup without invoking the system’s permission framework, allowing an authenticated user to retrieve lead details that they are not authorized to view. This results in the disclosure of sensitive customer information to users with low privileges. The flaw is a classic missing authorization defect, classified as CWE‑862.

The affected application is Frappe CRM by the vendor frappe. Versions prior to 1.89.1 are vulnerable; from 1.89.1 onward the issue is addressed.

The CVSS score of 7.1 indicates a medium‑to‑high severity risk. EPSS is not available, so the exploitation probability is not quantified, and the vulnerability is not listed in the CISA KEV catalog. Because the bug can be triggered by any authenticated low‑privilege user, the attack vector is a remote request to the API endpoint using valid credentials. Once the phone number is supplied the system returns full lead details that should otherwise be hidden by the standard API and UI controls.