CVE-2023-54410

Deferred Deferred - Pending Action

Improper Authorization in Frappe Leading to Document Renaming

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2023-54410

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Frappe before version 13.22.0 has an improper authorization vulnerability. Authenticated users can rename documents even if they lack permission to modify them. This happens because the system fails to check permissions before allowing the rename operation.

Impact Analysis

Attackers with valid credentials could alter records by renaming them without proper authorization. This could lead to data integrity issues, unauthorized changes, or confusion in records management.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data integrity, such as GDPR's data accuracy principle or HIPAA's integrity safeguards. Unauthorized modifications may lead to non-compliance.

Mitigation Strategies

Upgrade Frappe to version 13.22.0 or later to address the improper authorization vulnerability. Ensure proper permission checks are enforced for document renaming functionality.

Hi! I’m here to help you understand CVE-2023-54410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70