The vulnerability is an improper access control flaw in the email template permission system of the Frappe framework. Authenticated non‑guest users are able to create or edit any email template. This flaw enables an attacker to alter the content and recipients of application‑generated emails, supporting phishing, social engineering, or malware distribution. The weakness maps to CWE‑284: Improper Access Control.

The flaw exists in Frappe versions prior to 13.46.3 and in the 14.x branch before 14.21.1. The affected product is the Frappe framework from the vendor frappe.

The CVSS score is 7.1, indicating moderate to high severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Attackers require only an authenticated non‑guest account, which may be a low‑privileged or self‑registered user if signup is enabled. Because such accounts are often present on installations, the likelihood of exploitation is notable, especially where email templates are used for critical communications. The impact spans email content integrity and confidentiality, potentially enabling broader social engineering attacks.