fix(crm): check read permission on lead in add_lead_to_prospect

erpnext/crm/doctype/lead/lead.py

@@ -382,6 +382,9 @@ def get_lead_with_phone_number(number):
 
 @frappe.whitelist(methods=["POST"])
 def add_lead_to_prospect(lead: str, prospect: str):
+	if lead:
+		frappe.has_permission("Lead", "read", lead, throw=True)
+
 	prospect = frappe.get_doc("Prospect", prospect)
 	prospect.append("leads", {"lead": lead})
 	prospect.save()