CVE-2026-124314: Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities

Published Nov 7, 2026

Updated

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.getopenactivities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary refdoctype and refdocname values to enumerate activities and private calendar event details.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:17 PM

Data Sourced

via MITRE·02:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated ERPNext user can exploit it, including portal users and users with no assigned role. The issue does not require elevated permissions.

What access is exposed?

An attacker can provide arbitrary ref_doctype and ref_docname values to enumerate ToDo and Event activity records, including details from private calendar events.

Which versions need remediation?

ERPNext releases before 15.121.4 are affected, as are 16.x releases before 16.36.0. Upgrade to 15.121.4 or later in the 15.x line, or 16.36.0 or later in the 16.x line.

CVE-2026-124314: Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities

Event History

Frequently Asked Questions

Who can exploit this issue?

What access is exposed?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access is exposed?

Which versions need remediation?