Threats tagged 'ghsa-8ggh-cw83-mp5q'

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 have a missing authorization vulnerability in the erpnext.crm.utils.get_open_activities function. This flaw allows any authenticated user, including those with portal or no roles, to supply arbitrary reference document types and names to enumerate ToDo and Event records, exposing private calendar event details.