CVE-2026-124314

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 are vulnerable to a missing authorization flaw in the erpnext.crm.utils.get_open_activities component. This vulnerability allows any authenticated user, including those with no specific roles or portal access, to perform unauthorized...

EUVD-2026-119268

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.getopenactivities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary refdoctype and refdocname values to...