CVE-2026-111937

Frappe CRM versions prior to 1.81.2 are vulnerable to a missing authorization flaw (CWE-862) within the CRM Notification records . Due to the absence of necessary permission hooks, authenticated Sales Users can bypass intended access controls. Specifically, an attacker can query frappe.client end...

EUVD-2026-104314

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on touser or call markasread with another user argume...

CVE-2026-111937 Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on touser or call markasread with another user argume...