CVE-2026-111937 | Frappe CRM up to 1.81.1 Notification to_user improper authorization

October 19, 2026 Yanac

A vulnerability was found in Frappe CRM up to 1.81.1. It has been declared as critical. Impacted is an unknown function of the component Notification. Such manipulation of the argument to_user leads to improper authorization.

This vulnerability is uniquely identified as CVE-2026-111937. The attack can be launched remotely. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More