CVE-2023-54412 in Frappe
Summary
by MITRE • 10/13/2026
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability represents a critical failure in access control mechanisms within Frappe versions prior to 13.46.3 and 14.x prior to 14.21.1. This flaw specifically targets the permission system governing Email Templates, which are reusable components used by applications built on the Frappe framework to generate standardized email communications. The core technical issue stems from an improper access control configuration that fails to enforce role-based restrictions correctly when handling create and update operations for these specific objects. Consequently, the security boundary intended to restrict such modifications to administrators or users with elevated privileges is effectively bypassed by any authenticated user who does not fall under the guest category. This includes standard registered accounts as well as self-registered users if the platform allows public signup, thereby expanding the potential attack surface significantly beyond what was originally anticipated by the developers.
From a technical perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Management, and more specifically relates to CWE-862, Missing Authorization. The application logic likely checks for authentication status but fails to validate whether the authenticated user possesses the specific permissions required to modify Email Templates. In many web frameworks, including Frappe, object-level permissions are often managed through a combination of role definitions and explicit permission rules attached to document types. When these rules are misconfigured or when the validation middleware does not properly intercept write operations for this particular data type, it results in an authorization bypass. An attacker can exploit this by sending crafted HTTP requests that attempt to create new Email Templates or overwrite existing ones without triggering a forbidden error response, as the system incorrectly assumes the user has sufficient privileges based on their authenticated session state rather than their actual role-based permissions.
The operational impact of this vulnerability is severe due to the central role Email Templates play in application functionality and communication integrity. By allowing unauthorized users to create or edit these templates, an attacker can inject malicious content into outgoing emails generated by the system. This capability facilitates a range of attacks including phishing campaigns where attackers impersonate legitimate service providers to steal credentials from end-users. Furthermore, it enables cross-site scripting if the email template rendering engine processes user-supplied input without adequate sanitization, potentially leading to session hijacking or malware distribution when recipients open the emails. In enterprise environments, this could also lead to data leakage if templates are used for sensitive notifications and an attacker modifies them to exfiltrate information via external links embedded in the message body. The ability to modify system-wide communication channels undermines trust in the application's reliability and security posture.
To mitigate this risk, organizations running affected versions of Frappe must upgrade immediately to version 13.46.3 or later for the v13 branch, or version 14.21.1 or later for the v14 branch. These releases contain patches that correct the permission logic to ensure that only users with explicit administrative rights can manage Email Templates. In addition to upgrading, administrators should review their current user roles and permissions structure to enforce strict least-privilege principles. It is advisable to audit existing email templates for any signs of tampering or unauthorized modifications before applying the patch. For environments where public signup is enabled, extra vigilance is required as low-privileged accounts can be easily created by attackers to exploit this flaw until the update is applied. Monitoring logs for unusual creation patterns of Email Template documents can also serve as an early detection mechanism during the transition period.