From 02fcdc0337b3afab1eafd586c4a3d39444570b11 Mon Sep 17 00:00:00 2001
From: Shllokkk <shllokosan23@gmail.com>
Date: Wed, 2 Sep 2026 13:50:38 +0530
Subject: [PATCH] fix(crm): check read permission on lead in
 add_lead_to_prospect

---
 erpnext/crm/doctype/lead/lead.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/erpnext/crm/doctype/lead/lead.py b/erpnext/crm/doctype/lead/lead.py
index 18afd630636..bdd39c05828 100644
--- a/erpnext/crm/doctype/lead/lead.py
+++ b/erpnext/crm/doctype/lead/lead.py
@@ -382,6 +382,9 @@ def get_lead_with_phone_number(number):
 
 @frappe.whitelist(methods=["POST"])
 def add_lead_to_prospect(lead: str, prospect: str):
+	if lead:
+		frappe.has_permission("Lead", "read", lead, throw=True)
+
 	prospect = frappe.get_doc("Prospect", prospect)
 	prospect.append("leads", {"lead": lead})
 	prospect.save()