CVE-2023-54410

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-285

Impact

Authenticated attackers can rename arbitrary documents they lack permission to modify, compromising record integrity. They only need standard authenticated user access to trigger the rename action.

Root cause

The document rename function lacks proper authorization checks to verify if the requesting user has permission to modify the target record.

Affected systems

Frappe versions prior to 13.22.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade Frappe to version 13.22.0 or later. If updating immediately is not possible, restrict untrusted authenticated user access or block access to the document rename endpoint via custom server scripts or role permissions.

shell

$ bench update --apps frappe

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper authorization.

References

Source: nvd.nist.gov/vuln/detail/CVE-2023-54410