Missing Authorization Vulnerability in Frappe CRM Affects User Notification Records
CVE-2026-111937

5.3MEDIUM

Key Information:

Vendor

Frappe

Status
Crm
Vendor
CVE Published:
19 October 2026

What is CVE-2026-111937?

Frappe CRM versions earlier than 1.81.2 are impacted by a vulnerability that allows authenticated Sales Users to improperly access other users' Notification records due to a lack of necessary permission checks. This security flaw enables attackers to exploit frappe.client endpoints, filtering notifications by the 'to_user' parameter or invoking the 'mark_as_read' function with arguments pertaining to other users, leading to potential unauthorized reading, marking, or deletion of notifications.

Affected Version(s)

crm 0 < 1.81.2

References

https://github.com/frappe/crm/security/advisories/GHSA-4r...
vendor-advisory
https://github.com/frappe/crm/commit/a24d73acefa7f98f4690...
patch
https://github.com/frappe/crm/releases/tag/v1.81.2
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.