CVE-2023-54410: Frappe before 13.22.0 Improper Authorization via Document Rename
Published Oct 12, 2026
·Updated
Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper authorization.
Affected Software
1 affected component
Frappe frappe<13.22.0
Event History
Oct 12, 2026
CVE Published
via MITRE·10:21 PM
Data Sourced
via MITRE·10:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated Frappe user can exploit it. The issue affects users who lack permission to modify a document but can invoke the document rename functionality.
2
What is the impact of a successful exploit?
An attacker can rename documents they are not authorized to modify, altering records without proper authorization. The provided information does not indicate confidentiality or availability impact.
3
Which versions are affected?
Frappe versions before 13.22.0 are affected.