CVE-2026-124314— Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities

Quick assessment

Affected

frappe erpnext

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Frappe ERPNext 在 15.121.4 之前以及 16.x 在 16.36.0 之前的版本中，函数存在缺少授权控制的漏洞，导致 ToDo（待办事项）和 Event（事件）记录被暴露。任何已认证用户（包括门户用户或无角色用户）均可提供任意的和值，从而枚举活动记录并获取私有日历事件的详细信息。

CVSS 6.5 · Medium Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1040 · Network Sniffing T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities

Source: CVE Program / CVE List V5

Vulnerability Description

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary ref_doctype and ref_docname values to enumerate activities and private calendar event details.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
frappe	erpnext	0 ~ 15.121.4	-

II. Public POCs for CVE-2026-124314

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124314

请登录查看更多情报信息。

Other References for CVE-2026-124314 (5)

https://www.cve.org/CVERecord?id=CVE-2026-124314

Same Patch Batch · frappe · 2026-11-07 · 4 CVEs total

CVE-2026-124315	6.5 MEDIUM	Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items
CVE-2026-124313	4.3 MEDIUM	Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_f
CVE-2026-124316	4.3 MEDIUM	Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_r

IV. Related Vulnerabilities

Same product: erpnext

Same vendor: frappe

Same weakness: CWE-862