CVE-2026-111937: Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records

Q: Who can exploit this issue?

An authenticated user with the Sales User role can exploit it. The issue is exposed through frappe.client endpoints and does not require user interaction.

Q: What access can an attacker gain or change?

An attacker can query CRM Notification records belonging to other users, including by filtering on to_user. They can also invoke mark_as_read with another user's argument to mark those notifications as read or delete them.

Q: Which versions are affected?

Frappe CRM versions before 1.81.2 are affected. Version 1.81.2 is identified as the release containing the fix.

Q: How can I check whether exploitation may have occurred?

Review use of frappe.client endpoints for queries filtering CRM Notification records by to_user, and review mark_as_read calls that specify another user. Look for Sales User accounts accessing, marking read, or deleting notification records that belong to other users.

Published Oct 19, 2026

Updated

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on touser or call markasread with another user argument to read, mark read, or delete others' notifications.

Affected Software

1 affected component

Frappe CRM<1.81.2

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with the Sales User role can exploit it. The issue is exposed through frappe.client endpoints and does not require user interaction.

What access can an attacker gain or change?

An attacker can query CRM Notification records belonging to other users, including by filtering on to_user. They can also invoke mark_as_read with another user's argument to mark those notifications as read or delete them.

Which versions are affected?

Frappe CRM versions before 1.81.2 are affected. Version 1.81.2 is identified as the release containing the fix.

How can I check whether exploitation may have occurred?

Review use of frappe.client endpoints for queries filtering CRM Notification records by to_user, and review mark_as_read calls that specify another user. Look for Sales User accounts accessing, marking read, or deleting notification records that belong to other users.

CVE-2026-111937: Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain or change?

Which versions are affected?

How can I check whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain or change?

Which versions are affected?

How can I check whether exploitation may have occurred?