Description
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
frappe crm
Default version status: unaffected
0 to < 1.81.2affected
pkg:github/frappe/crmReferences
- https://github.com/frappe/crm/security/advisories/GHSA-4rjw-6mxx-m345 ↗
- https://github.com/frappe/crm/commit/a24d73acefa7f98f46903858514444442ce57614 ↗
- https://github.com/frappe/crm/releases/tag/v1.81.2 ↗
- https://github.com/frappe/crm/blob/v1.81.1/crm/api/notifications.py ↗
- https://github.com/frappe/crm/blob/v1.81.1/crm/hooks.py ↗
- https://github.com/frappe/crm/blob/v1.81.1/crm/fcrm/doctype/crm_notification/crm_notification.json ↗
- https://www.vulncheck.com/advisories/frappe-crm-before-1.81.2-missing-authorization-on-crm-notification-records ↗