Read the docs
TI-2026-76443 Aliases CVE-2026-111937GHSA-6wh4-r87p-4qfj

Frappe CRM Missing Authorization on CRM Notification Records

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Frappe CRM versions before 1.81.2 lack authorization checks on CRM Notification records because permission hooks are missing. An authenticated user with the Sales User role can read, mark as read, or delete notifications belonging to other users. An attacker can query frappe.client endpoints filtered on to_user, or call mark_as_read with another user's name. The weakness is classified as CWE-862 (Missing Authorization).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed crm (frappe): 1.81.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
frappecrmbefore 1.81.21.81.2Patch availableCNA
  • crm Vendorfrappe Affected before 1.81.2 Fixed in 1.81.2 Patch available CNA

Remediation

Upgrade Frappe CRM to version 1.81.2 or later. Versions before 1.81.2 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA crm (frappe) Fixed in 1.81.2

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-111937
  2. 2026-10-19 Alias added: GHSA-6wh4-r87p-4qfj
  3. 2026-10-20 CISA SSVC decision points changed

References

Patch 1

Advisory 1

Other 4

  • TI-2026-28140 ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). CVSS 3.1CRITICAL 9.8
  • TI-2025-40873 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
  • TI-2025-40872 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
  • TI-2025-40871 A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext… CVSS 3.1CRITICAL 9.8
  • TI-2025-32462 In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at… CVSS 3.1HIGH 8.2
  • TI-2025-32461 In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at… CVSS 3.1HIGH 8.2
See all 321 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences