CVE-2023-54412

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-284

Impact

Low-privileged authenticated users, including self-registered accounts, can create and modify any email template used by the application. This allows attackers to alter system-generated emails sent to other users.

Root cause

Improper access control checks on Email Template permissions allow any authenticated non-guest user to edit and create templates.

Affected systems

Frappe versions prior to 13.46.3, and 14.x prior to 14.21.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Fix & remediation

Upgrade Frappe to version 13.46.3, 14.21.1, or later. If patching immediately is not possible, disable public user signup to stop unauthorized self-registration.

shell

$ bench update --apps frappe

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.

References

Source: nvd.nist.gov/vuln/detail/CVE-2023-54412