CVE-2026-111937 in Frappe
Summary
by MITRE • 10/19/2026
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified security flaw in Frappe CRM versions prior to 1.81.2 represents a critical failure in access control mechanisms, specifically categorized under CWE-269 Improper Privilege Management and more precisely as CWE-862 Missing Authorization. This vulnerability stems from the absence of robust permission hooks within the application's backend logic when handling customer relationship management notifications. The core technical deficiency lies in how the system validates user identity against resource ownership for specific API endpoints, particularly those related to CRM notification records. While the authentication layer successfully verifies that a user is logged into the system as an authenticated Sales User, it fails to enforce strict authorization checks ensuring that this user only interacts with resources explicitly assigned to their account.
The operational impact of this vulnerability allows any authenticated attacker possessing valid credentials for a standard Sales User role to bypass intended security boundaries and access sensitive data belonging to other users within the same organization. By exploiting missing validation logic, an adversary can manipulate API requests directed at frappe.client endpoints. Specifically, by filtering queries on parameters such as to_user or supplying alternative user arguments in functions like mark_as_read, attackers can retrieve notification records that are not intended for their view. This capability extends beyond mere data exfiltration; it also permits the modification of state indicators and the deletion of critical communication logs associated with other employees, thereby compromising both confidentiality and integrity within the CRM environment.
From a tactical perspective, this vulnerability aligns closely with techniques observed in the MITRE ATT&CK framework, particularly those related to Collection via API Abuse or Unauthorized Access to Resources. The ability to read others' notifications can facilitate further reconnaissance efforts where an attacker gathers intelligence on internal workflows, pending approvals, or sensitive business discussions recorded within the notification system. Furthermore, the capacity to mark items as read or delete them disrupts operational continuity and may be used to cover tracks after initial unauthorized access has been established. Such actions undermine trust in the integrity of the communication channel and can lead to significant organizational disruption if critical alerts are silently suppressed by malicious actors.
Mitigation strategies must prioritize immediate patching to version 1.81.2 or later, where these permission hooks have been properly implemented to enforce strict ownership checks on all notification-related API calls. In addition to updating the software, organizations should implement rigorous input validation and ensure that every request involving user-specific data includes server-side verification of resource ownership against the authenticated session's identity. Security teams should also audit existing access control lists for similar patterns across other modules within Frappe CRM to prevent analogous vulnerabilities in different functional areas. Continuous monitoring of API logs for anomalous querying patterns, such as frequent requests targeting non-owned notification IDs, can provide early detection indicators while long-term architectural improvements are deployed to harden the application against privilege escalation and unauthorized data access attempts.