CVE-2026-111937
CVE-2026-111937 · Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
CVSS 5.3 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
crm
- Versiones
- ≥ 0, < 1.81.2: Afectada (semver)
Actualiza a 1.81.2
Fuentes originales
- https://github.com/frappe/crm/security/advisories/GHSA-4rjw-6mxx-m345
- https://github.com/frappe/crm/commit/a24d73acefa7f98f46903858514444442ce57614
- https://github.com/frappe/crm/releases/tag/v1.81.2
- https://github.com/frappe/crm/blob/v1.81.1/crm/api/notifications.py
- https://github.com/frappe/crm/blob/v1.81.1/crm/hooks.py
- https://github.com/frappe/crm/blob/v1.81.1/crm/fcrm/doctype/crm_notification/crm_notification.json
- https://www.vulncheck.com/advisories/frappe-crm-before-1.81.2-missing-authorization-on-crm-notification-records
- https://nvd.nist.gov/vuln/detail/CVE-2026-111937