Three authorisation flaws found in Frappe Helpdesk and CRM

CVE-2026-111937, CVE-2026-111938 and CVE-2026-111939 were published for Frappe applications: a spoofed raised_by lets authenticated portal users create tickets as other customers and read their replies, an arbitrary call_sid allows editing others' call logs, and a CRM notifications endpoint lacks an authorisation check. Fixes shipped in Helpdesk 1.26.0 and CRM 1.74.0/1.81.2.

• CVE-2026-111939 (CVSS 4.6): spoofed raised_by in Helpdesk before 1.26.0 exposes victim replies
• CVE-2026-111938 (CVSS 4.3): arbitrary call_sid in CRM before 1.74.0 allows editing others' call logs
• CVE-2026-111937: CRM before 1.81.2 lacks access checks on other users' notifications
• All three NVD records are marked Deferred; fixes are release-level