All vulnerabilities
CVE-2023-54412GHSA-f939-v9q6-j3wg

Frappe before 13.46.3 Improper Access Control for Email Templates

frappe frappe
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in13.46.3Also 14.21.1CVE List
Published12 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.

Text from CVE List

Affected versions 4

  • frappeaffected: all versions before 13.46.3CVE List
  • frappeaffected: 14.0.0-beta.1 before 14.21.1CVE List
  • frappeunaffected: 13.46.3CVE List
  • frappeunaffected: 14.21.1CVE List

References 2