CVE-2026-111937GHSA-4rjw-6mxx-m345
Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
frappe crm
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.81.2crmCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
Text from CVE List
Affected versions 1
- crmaffected: all versions before 1.81.2CVE List
References 7
- github.com/frappe/crm/commit/a24d73acefa7f98f46903858514444442ce57614Fixvia CVE List
- github.com/frappe/crm/releases/tag/v1.81.2Fixvia CVE List
- github.com/frappe/crm/security/advisories/GHSA-4rjw-6mxx-m345Advisoryvia CVE List
- vulncheck.com/advisories/frappe-crm-before-1.81.2-missing-authorization-on-crm-notification-recordsAdvisoryvia CVE List
- github.com/frappe/crm/blob/v1.81.1/crm/api/notifications.pyReferencevia CVE List
- github.com/frappe/crm/blob/v1.81.1/crm/hooks.pyReferencevia CVE List
- github.com/frappe/crm/blob/v1.81.1/crm/fcrm/doctype/crm_notification/crm_notification.jsonReferencevia CVE List