Description
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | frappe | < 13.46.3, 14.0.0-beta.1 – < 14.21.1 | 13.46.3 |
References
- GitHub Security Advisory (GHSA-f939-v9q6-j3wg) vendor-advisory
- VulnCheck Advisory: Frappe before 13.46.3 Improper Access Control for Email Templates third-party-advisory