CVE-2023-54412

MEDIUM 6.5

Frappe before 13.46.3 Improper Access Control for Email Templates

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.

CWE	CWE-284
Vendor	frappe
Product	frappe
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for frappe frappe

Be the first to know when new medium vulnerabilities affecting frappe frappe are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

frappe / frappe

0 < 13.46.3 14.0.0-beta.1 < 14.21.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/frappe/security/advisories/GHSA-f939-v9q6-j3wg vulncheck.com: https://www.vulncheck.com/advisories/frappe-before-13.46.3-improper-access-control-for-email-templates

Credits

sagarvora