CVE-2026-111937 — Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permi…
Published: 2026-10-19 · CVSS: 5.3 · CVSS 4.0
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7