An authorization flaw exists in the `get open activities()` function within `erpnext.crm.utils`. This issue allows any authenticated user, including those with portal access or no assigned roles, to access ToDo and Event records. By providing arbitrary values to the `ref doctype` and `ref docname` variables, an attacker can enumerate activities and retrieve private calendar event details.