CVE-2026-111937Medium· 5.4▾ SunlitFrappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints fil…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
crm < 1.81.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111938Medium· 4.3Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
CVE-2026-108734Medium· 4.3Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks
CVE-2026-92402Medium· 6.3A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd
CVE-2026-64862Medium· 6.5Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
CVE-2026-108373Medium· 6.5ERPNext: Unauthorised access to financial data due to missing validation
CVE-2026-108374High· 7.7ERPNext: Unauthorised status modification due to missing validation