Live › vulnerability › CVE-2026-111937
Go to dashboardFrappe CRM before 1.81.2 is missing permission checks on CRM Notification records. A signed-in Sales User can read, mark as read, or delete notifications belonging to other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Frappe CRM before 1.81.2 with more than one Sales User account. The flaw needs a valid login with the Sales User role; instances with no such users, or with only admin accounts, are not exposed to this path.
No product ranges from the sources yet.
1.81.2 in the app's apps/crm directory or the bench app list (bench version).1.81.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
This page as .md · .json · in your agent: get_signal("CVE-2026-111937")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.