CVE-2026-111937
Received Received - Intake

Frappe CRM Missing Authorization in Notifications

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111937
EUVD
EUVD-2026-104314

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frappe crm 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111937 is a missing authorization vulnerability in Frappe CRM versions before 1.81.2. It allows authenticated Sales Users to access, read, mark as read, or delete other users' CRM Notification records due to absent permission hooks. Attackers can exploit this by querying endpoints like frappe.client with filters or using mark_as_read with another user's argument.

Detection Guidance

Check for unauthorized access to CRM Notification records by monitoring API calls to frappe.client endpoints filtering on to_user or mark_as_read with another user argument. Review logs for suspicious activity in versions prior to 1.81.2.

Impact Analysis

This vulnerability allows unauthorized access to sensitive CRM notifications, potentially exposing confidential information. Attackers with Sales User access could view, alter, or delete notifications belonging to other users, leading to data leaks or misinformation. The impact depends on the sensitivity of the data in notifications.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access risks data breaches, leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Frappe CRM to version 1.81.2 or later to apply the patch that enforces row-level permission checks for CRM notifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111937. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart