Frappe ERPNext versions prior to 15.121.4 and 16.36.0 contain a missing authorization flaw in the erpnext.crm.utils.get_open_activities function. The vulnerability allows any authenticated user—including portal users and users with no assigned role—to pass arbitrary reference doctype and document name parameters and retrieve ToDo and Event records. Because access control is bypassed, attackers can enumerate private calendar event details and ToDo items, exposing sensitive organizational data. The flaw aligns with CWE‑862, where an insufficient check for the proper authorization is performed.

The affected products are Frappe ERPNext. Specifically, all releases before version 15.121.4 and before version 16.36.0 are impacted. Users running these older builds on any deployment should consider themselves vulnerable.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score is unavailable, but the fact that anyone authenticated can exploit the issue raises the likelihood of use in practice. The vulnerability is not currently listed in the CISA KEV catalog, yet it can be leveraged locally by authenticated actors, making it a concern for organizations with widespread internal access. Attackers would simply authenticate to the system and call the get_open_activities endpoint with crafted parameters; no external exploitation beyond normal login is required.