Frappe CRM CVE-2026-111937

Requires a valid authenticated account with at least Sales User role on the target Frappe CRM instance (below System Manager/Administrator, which are exempted by the patched permission hooks). Exploitation works against default configurations of vulnerable versions (before 1.81.2) because the CRM Notification doctype lacked any get_permission_query_conditions or has_permission hook, and the mark_as_read API accepted an attacker-supplied user argument. The limiting factors are the authentication requirement (PR:L - not unauthenticated) and the fact that impact is confined to CRM Notification records (read, mark-read, delete) rather than core CRM data; System Manager and Administrator accounts are unaffected by the authorization gap.

This is a medium-severity (CVSS 5.3) missing-authorization flaw (CWE-862) whose signals are internally consistent and point to a real but bounded issue rather than a top-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires existing low privileges (PR:L) - an authenticated Sales User account - which caps impact to VC:L/VI:L with no availability impact (VA:N) and no scope/subsequent-system change (SC:N/SI:N). No EPSS score, KEV listing, or public POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; however, the source-code commit diff is public and makes the exploit path trivially derivable (removing the attacker-controlled user argument from mark_as_read and adding get_permission_query_conditions/has_permission hooks), which lowers the practical bar to weaponization even absent a packaged POC. Signals are not conflicting: the technical-impact ceiling is genuinely low because an attacker can only read, mark-read, or delete other users' CRM Notification records - metadata, not primary CRM business data or credentials. The main caveat is that exploitation presupposes a valid authenticated account on the target instance, making this most relevant as an insider/multi-tenant trust-boundary issue rather than an internet-wide mass-exploitation risk.

An authenticated Sales User with a legitimate Frappe CRM login queries a frappe.client list/get endpoint filtering CRM Notification records on the to_user field belonging to a colleague, enumerating and reading their notifications, then calls mark_as_read with another user's argument to mark or delete those records. No public exploit is identified, but the fix commit publicly reveals the exact vulnerable parameter and endpoints, making the attack straightforward to reproduce. The attack is network-reachable with low complexity but requires valid low-privilege credentials.