CVE-2023-54412CWE-284broken-access-control

CVE-2023-54412

Medium · published October 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00221 · 12.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-10-13T03:17Z
References (2)
https://github.com/frappe/frappe/security/advisories/GHSA-f939-v9q6-j3wg · [email protected]https://www.vulncheck.com/advisories/frappe-before-13.46.3-improper-access-control-for-email-templates · [email protected]
EPSS history
Timeline
  • 14 OCT 03:20Z
    EPSS moved — → 0%
    epss
  • 12 OCT 22:21Z
    Frappe before 13.46.3 Improper Access Control for Email Templates
    cvelistv5
  • 12 OCT 22:21Z
    Frappe before 13.46.3 Improper Access Control for Email Templates
    cvelistv5