Quick answers
- Is CVE-2023-54412 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-54412 being exploited in the wild.
- How severe is CVE-2023-54412?
- Medium severity, with a CVSS score of 6.5, published 12 October 2026.
- Which products and versions are affected?
- Frappe before 13.46.3, 14.x before 14.21.1.
- Is there a fix for CVE-2023-54412?
- Yes: fixed in 13.46.3, 14.21.1. Until then: Remove the "All" role's permissions from the Email Template resource, and optionally disable user signup from Website Settings to reduce the number of potential low-privileged accounts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-54412 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2023-54412?
- Check whether you run Frappe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 13.46.3, 14.21.1
Remove the "All" role's permissions from the Email Template resource, and optionally disable user signup from Website Settings to reduce the number of potential low-privileged accounts.
Technical details
The Email Template resource in Frappe lacks proper permission checks, allowing non-guest authenticated users to bypass role-based access controls and perform create and edit operations. The vulnerability affects versions before 13.46.3 and 14.x before 14.21.1 and requires only a low-privileged account with authentication; no network complexity or user interaction is needed. An attacker can modify email templates to inject arbitrary content that will be sent to other users, affecting confidentiality, integrity, and potentially availability of the application.
Affected products
- Frappe Frappe before 13.46.3, 14.x before 14.21.1
Timeline
- 2023-02-22: disclosed
- 2026-10-12: advisory