CVE-2026-111937

Impact

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.

Affected products

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/frappe/crm/blob/v1.81.1/crm/api/notifications.py
• https://github.com/frappe/crm/blob/v1.81.1/crm/fcrm/doctype/crm_notification/crm_notification.json
• https://github.com/frappe/crm/blob/v1.81.1/crm/hooks.py
• https://github.com/frappe/crm/commit/a24d73acefa7f98f46903858514444442ce57614
• https://github.com/frappe/crm/releases/tag/v1.81.2
• https://github.com/frappe/crm/security/advisories/GHSA-4rjw-6mxx-m345
• https://www.vulncheck.com/advisories/frappe-crm-before-1.81.2-missing-authorization-on-crm-notification-records