CVE-2026-124314
Deferred Deferred - Pending Action

Authentication Bypass in Frappe ERPNext

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: VulnCheck

Description
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary ref_doctype and ref_docname values to enumerate activities and private calendar event details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-124314
EUVD
EUVD-2026-119268

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe erpnext to 15.121.4 (exc)
frappe erpnext to 16.36.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 have a missing authorization vulnerability in the function erpnext.crm.utils.get_open_activities. This flaw allows any authenticated user, including those with no roles or portal access, to bypass authorization checks by providing arbitrary ref_doctype and ref_docname values. As a result, they can enumerate ToDo and Event records, including private calendar event details.

Impact Analysis

An attacker could exploit this to access sensitive information such as private calendar events and ToDo items without proper authorization. This could lead to data leaks, privacy violations, or unauthorized access to confidential business or personal data stored in the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR due to unauthorized access to personal data and potential privacy breaches. For HIPAA, if the system handles protected health information, unauthorized access could result in violations of confidentiality requirements. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Update Frappe ERPNext to version 15.121.4 or later if using version 15.x, or to version 16.36.0 or later if using version 16.x. This addresses the missing authorization vulnerability in erpnext.crm.utils.get_open_activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...