CVE-2026-111937— Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
Quick assessment
Affected
frappe crm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe CRM 1.81.2 之前的版本存在一个缺少授权检查的漏洞。该漏洞允许已认证的“销售用户”（Sales Users）因权限钩子缺失而访问其他用户的 CRM 通知记录。攻击者可以通过在 frappe.client 端点查询时过滤 字段，或调用 方法并传入其他用户的标识，从而读取、标记为已读或删除其他用户的通知。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111937
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-111937
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111937
请登录查看更多情报信息。
Other References for CVE-2026-111937 (7)
-
https://github.com/frappe/crm/blob/v1.81.1/crm/api/notifications.py technical-description
-
https://github.com/frappe/crm/blob/v1.81.1/crm/hooks.py technical-description
-
https://github.com/frappe/crm/releases/tag/v1.81.2 release-notes
Same Patch Batch · frappe · 2026-10-19 · 3 CVEs total
| CVE-2026-111939 | 4.6 MEDIUM | Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation |
| CVE-2026-111938 | 4.3 MEDIUM | Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log |
IV. Related Vulnerabilities
Same product: crm
-
CVE-2026-111938
Frappe CRM before 1.74.0 Missing Authorization via add_note_ -
CVE-2026-108734
Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via g -
CVE-2021-48008
Chanjet CRM SQL Injection via get_usedspace.php -
CVE-2026-92418
ChangeWeDer crm Save Endpoint customer.serve.js cross site s -
CVE-2026-92402
ChangeWeDer crm top.upstudy.crm.controller.UserController Us
Same vendor: frappe
-
CVE-2026-111938
Frappe CRM before 1.74.0 Missing Authorization via add_note_ -
CVE-2026-111939
Frappe Helpdesk before 1.26.0 Authorization Bypass via raise -
CVE-2026-64862
Frappe HR: Missing Authorization on PWA API Endpoints enable -
CVE-2026-55796
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Rep -
CVE-2026-108373
ERPNext: Unauthorised access to financial data due to missin
Same weakness: CWE-862
-
CVE-2026-112778
Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Re -
CVE-2025-7043
Refresh Token Misuse via Validation Flaw in Multiple WSO2 Pr -
CVE-2026-111058
Mercury: Unauthenticated Remote Code Execution via /api/kern -
CVE-2026-111046
FOSSBilling: Low-privileged staff can read and modify config -
CVE-2026-107566
Missing Authorization in hMailServer
V. Comments for CVE-2026-111937
No comments yet