What’s Vulnerable › Vulnerabilities

CVE-2023-54412: Frappe before 13.46.3 Improper Access Control for Email Templates

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-14
• Weakness: CWE-284

Description

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.

Affected products

• frappe: before 13.46.3; from 14.0.0-beta.1 before 14.21.1 — fixed in 13.46.3, 14.21.1

How to fix

Upgrade to a fixed version: frappe 13.46.3, 14.21.1. Check the vendor advisory for mitigations.

References

• https://github.com/frappe/frappe/security/advisories/GHSA-f939-v9q6-j3wg
• https://www.vulncheck.com/advisories/frappe-before-13.46.3-improper-access-control-for-email-templates

Get alerted when CVE-2023-54412 or the next vulnerability affects your stack