Frappe
CVE-2026-124314: Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo
CVE-2026-124314 Nov 7, 2026 Source: Vendor
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary ref_doctype and ref_docname values to enumerate activities and private calendar event details.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-124314
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
4 lines
Showing 1–4 of 4
CVE-2026-124314
BR2026-0000-043339
unclaimed
Credited as Shohruh Yo'ldoshov
CVE-2026-124314
BR2026-0000-043340
unclaimed
Credited as Secure-Plex
CVE-2026-124314
BR2026-0000-043341
unclaimed
Credited as 360 AlphaLab
CVE-2026-124314
BR2026-0000-043342
unclaimed
Credited as Dahmani Toumi