CVE Feed

    Dashboard / CVE / CVE-2023-54412

    CVE-2023-54412

    Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.

    Published:Oct 12, 2026
    Last Modified:Oct 14, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00221
    CVSS Score:6.5

    Affected Products

    Vendor
    Frappe
    Product
    Frappe

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-119145 (CVSS 9.4) — Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-up…
    CVE-2026-119144 (CVSS 8.7) — Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerabili…
    CVE-2026-114664 (CVSS 7.1) — Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.…
    CVE-2026-111388 (CVSS 5.3) — Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist f…
    CVE-2026-55823 (CVSS 8.7) — Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview compo…
    CVE-2026-66057 (CVSS 5.1) — Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an …
    CVE-2026-109603 (CVSS 4.8) — Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-…
    CVE-2026-109602 (CVSS 5.1) — Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboa…
    CVE-2026-109601 (CVSS 7.1) — Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the …
    CVE-2026-109600 (CVSS 6.9) — Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled bef…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High