CVE-2023-54410

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper authorization.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Oct 12, 2026
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-544115.9Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed CVE-2023-544126.5Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows an CVE-2023-544136.1WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated CVE-2023-54437.5Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. T CVE-2023-54448.0A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to succes CVE-2023-54455.4An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL p CVE-2023-54475.5Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in den CVE-2023-54488.8The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.CVE-2023-54493.3A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a moni CVE-2023-54507.8An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of p CVE-2023-54516.1Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client down CVE-2023-54525.4Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.