← Database

CVE-2026-124314

MEDIUM CVSS: 6.5 Published: 2026-11-07 Modified: 2026-11-07

Description

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary ref_doctype and ref_docname values to enumerate activities and private calendar event details.

Affected Platforms

Unknown

Weakness Type

CWE-862

References