CVE-2026-124314

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.4 Frappe ERPNext versions 16.x prior to 16.36.0

Description An authorization flaw exists in the get open activities() function within erpnext.crm.utils. This issue allows any authenticated user, including those with portal access or no assigned roles, to access ToDo and Event records. By providing arbitrary values to the ref doctype and ref docname variables, an attacker can enumerate activities and retrieve private calendar event details.

Recommendations Update to version 15.121.4 or later. Update to version 16.36.0 or later.