A flaw in Frappe CRM allows an unauthenticated user to use logged invitation keys sent through the /crm/api endpoint to gain access without supplying valid credentials. This bypass can grant the attacker the same privileges as the invited user, potentially exposing customer data and internal communications. The weakness is an instance of CWE‑287, improper authentication.

Version 1.73.0 and later of the open‑source Frappe CRM product implement the fix. All earlier releases, including 1.72.x and older, are vulnerable. The vendor is Frappe, with the product named CRM.

The CVSS score of 8.2 places the vulnerability in the High severity range, indicating significant risk to confidentiality and integrity. EPSS data are not provided, so current exploitation probability cannot be quantified, but lack of mitigation options in earlier releases makes exploitation likely if the API is exposed. The vulnerability is not listed in CISA KEV, but the presence of a public advisory suggests the possibility of active exploitation. The attack vector is inferred to be remote over the network, requiring access to the /crm/api endpoint.