CVE-2023-54412 — Frappe before 13.46.3 Improper Access Control for Email Templates
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to cre…
Published: 2026-10-12 · CVSS: 7.1 · CVSS 4.0
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7