Description
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized access to CRM notifications
Action: Apply patch
AI Analysis

Impact

The vulnerability is a missing authorization check that allows authenticated Sales Users to view, mark as read, or delete CRM Notification records belonging to other users. This flaw permits unauthorized disclosure and tampering of user notifications, compromising confidentiality and integrity of personal notification data. It is rooted in CWE‑862, the missing authorization weakness.

Affected Systems

All releases of Frappe CRM before version 1.81.2 are affected. The flaw exists in the CRM Notification module and related permission hooks. Users running older versions without the update are at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The exploit requires authenticated access as a Sales User; no special prerequisites beyond a normal role. EPSS is not available and the vulnerability is not listed in KEV, suggesting no widespread exploitation reports yet. Nevertheless, because any Sales User can leverage the flaw to read or alter other users’ notifications, the risk remains moderate, especially in environments with many Sales Users.

Generated by OpenCVE AI on October 19, 2026 at 15:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Frappe CRM v1.81.2 or later to address the missing authorization vulnerability.
  • Restrict Sales User permissions to prevent them from specifying other users when filtering notifications or marking notifications as read; review permission hooks to enforce user ownership.
  • Audit existing notification data to identify any unauthorized read, delete, or modify actions performed by Sales Users, and remediate affected records or user activities.

Generated by OpenCVE AI on October 19, 2026 at 15:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
Title Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
First Time appeared Frappe
Frappe frappe Crm
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:frappe_crm:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe frappe Crm
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Frappe Crm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T18:11:17.821Z

Reserved: 2026-10-17T12:20:52.372Z

Link: CVE-2026-111937

cve-icon Vulnrichment

Updated: 2026-10-19T18:08:41.142Z

cve-icon NVD

Status : Received

Published: 2026-10-19T14:17:01.350

Modified: 2026-10-19T19:17:24.393

Link: CVE-2026-111937

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:00:15Z

Weaknesses