CVE-2023-54412

Deferred Deferred - Pending Action

Improper Access Control in Frappe Email Templates

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2023-54412

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	14.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Frappe versions before 13.46.3 and 14.x before 14.21.1 have an improper access control flaw in Email Template permissions. This allows any authenticated non-guest user, including low-privileged accounts and self-registered users, to create and edit any Email Template in the application.

Detection Guidance

Check Frappe version with: bench version. If using Frappe 13.x, versions before 13.46.3 are vulnerable. For 14.x, versions before 14.21.1 are vulnerable. Review Email Template permissions in the application to confirm improper access control.

Impact Analysis

Attackers with low-privileged accounts could modify Email Templates used by the application. This may lead to phishing attacks, misinformation, or unauthorized changes to system communications, potentially compromising data integrity and user trust.

Compliance Impact

This vulnerability could lead to unauthorized modifications of email communications, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. It may result in non-compliance due to improper access to sensitive data.

Mitigation Strategies

Upgrade Frappe to version 13.46.3 or later for Frappe 13.x, or 14.21.1 or later for Frappe 14.x. Review and restrict Email Template permissions to ensure only authorized users can modify them.

Hi! I’m here to help you understand CVE-2023-54412. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70