CVE-2023-54412: Frappe before 13.46.3 Improper Access Control for Email Templates
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 13.46.3
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated non-guest user can create and edit Email Templates. This includes low-privileged accounts and, where signup is enabled, self-registered users.
Which releases need remediation?
Frappe versions earlier than 13.46.3 and 14.x versions earlier than 14.21.1 are affected. Updating to 13.46.3 or later in the 13.x line, or 14.21.1 or later in the 14.x line, addresses the affected version ranges.
What should be prioritized if upgrades cannot happen immediately?
Prioritize restricting access by preventing untrusted users from obtaining authenticated non-guest accounts, particularly through self-registration where it is enabled. Review the risk of Email Templates used by the application being modified by low-privileged users.