CVE-2026-111937

Name of the Vulnerable Software and Affected Versions Frappe CRM versions prior to 1.81.2

Description Authenticated Sales Users can access CRM Notification records belonging to other users because of missing permission hooks. This allows an attacker to read, mark as read, or delete notifications of other users by querying frappe.client endpoints using the to user filter or by calling the mark as read() function with another user's argument.

Recommendations Update to version 1.81.2 or later.