# CVE-2023-54412: Frappe improper access control in Email Template permissions

Source: https://junglewise.ai/threats/cve-2023-54412-frappe-before-13-46-3-and-14-x-before-14-21-1-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2023-54412 · Severity: medium · CVSS 6.5 · Published 2026-10-12

Frappe is a web-based application framework used to build business applications. An access control flaw allows any authenticated user, including those with minimal privileges or self-registered accounts, to create and modify email templates that the application uses for communications. An attacker could inject malicious content into email templates to send phishing messages, expose sensitive data, or compromise other users of the system.

Technologies: [Frappe](https://junglewise.ai/threats/technologies/frappe). Vendors: [Frappe](https://junglewise.ai/threats/vendors/frappe).

## Quick answers

**Is CVE-2023-54412 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-54412 being exploited in the wild.

**How severe is CVE-2023-54412?** Medium severity, with a CVSS score of 6.5, published 12 October 2026.

**Which products and versions are affected?** Frappe before 13.46.3, 14.x before 14.21.1.

**Is there a fix for CVE-2023-54412?** Yes: fixed in 13.46.3, 14.21.1. Until then: Remove the "All" role's permissions from the Email Template resource, and optionally disable user signup from Website Settings to reduce the number of potential low-privileged accounts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-54412 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-54412?** Check whether you run Frappe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 13.46.3, 14.21.1

Remove the "All" role's permissions from the Email Template resource, and optionally disable user signup from Website Settings to reduce the number of potential low-privileged accounts.

## Technical details

The Email Template resource in Frappe lacks proper permission checks, allowing non-guest authenticated users to bypass role-based access controls and perform create and edit operations. The vulnerability affects versions before 13.46.3 and 14.x before 14.21.1 and requires only a low-privileged account with authentication; no network complexity or user interaction is needed. An attacker can modify email templates to inject arbitrary content that will be sent to other users, affecting confidentiality, integrity, and potentially availability of the application.

## Affected products

- Frappe Frappe before 13.46.3, 14.x before 14.21.1

## Timeline

- 2023-02-22: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/frappe/frappe/security/advisories/GHSA-f939-v9q6-j3wg](https://github.com/frappe/frappe/security/advisories/GHSA-f939-v9q6-j3wg)
- [https://www.vulncheck.com/advisories/frappe-before-13.46.3-improper-access-control-for-email-templates](https://www.vulncheck.com/advisories/frappe-before-13.46.3-improper-access-control-for-email-templates)

## Related threats

- [Frappe path traversal in file upload](https://junglewise.ai/threats/cve-2026-119145-frappe-before-15-121-0-and-16-x-before-16-34-0-contains-a-path)
- [Frappe open redirect in OAuth login flow](https://junglewise.ai/threats/cve-2026-66057-frappe-is-a-full-stack-web-application-framework-prior-to-15-116)
- [Frappe SQL injection in reportview get_count method](https://junglewise.ai/threats/cve-2026-55823-frappe-is-a-full-stack-web-application-framework-prior-to-16-23-0)
- [Frappe missing authorization in record modification](https://junglewise.ai/threats/cve-2026-109599-frappe-before-15-113-3-and-16-x-before-16-25-0-contains-a)
- [Frappe LDAP injection in endpoint parameters](https://junglewise.ai/threats/cve-2025-71431-frappe-before-14-99-2-and-15-x-before-15-86-0-contains-an-ldap)