Read the docs
TI-2022-07229 Aliases CVE-2022-23055GHSA-gxgf-4cfv-cmq2

ERPNext - Improper user access conrol

Priority LOW 27CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.

Why it matters now

EPSS 0.01197 68th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
frappefrappev11.0.3-beta.1 and later; up to v13.14.1—No fix listedCNA
  • frappe Vendorfrappe Affected v11.0.3-beta.1 and later; up to v13.14.1 Fixed in — No fix listed CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*11.0.4 to before 13.1.0Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta1:*:*:*:*:*:*11.0.3 beta1Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:*11.0.3 beta10Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:*11.0.3 beta11Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:*11.0.3 beta12Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:*11.0.3 beta13Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:*11.0.3 beta14Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:*11.0.3 beta15Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:*11.0.3 beta16Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:*11.0.3 beta17Vulnerablefrappe
  • cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* Versions 11.0.4 to before 13.1.0 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta1:*:*:*:*:*:* Versions 11.0.3 beta1 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta10:*:*:*:*:*:* Versions 11.0.3 beta10 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta11:*:*:*:*:*:* Versions 11.0.3 beta11 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta12:*:*:*:*:*:* Versions 11.0.3 beta12 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta13:*:*:*:*:*:* Versions 11.0.3 beta13 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta14:*:*:*:*:*:* Versions 11.0.3 beta14 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta15:*:*:*:*:*:* Versions 11.0.3 beta15 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta16:*:*:*:*:*:* Versions 11.0.3 beta16 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta17:*:*:*:*:*:* Versions 11.0.3 beta17 Vulnerable ·frappe
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:*11.0.3 beta18Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:*11.0.3 beta19Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:*11.0.3 beta2Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:*11.0.3 beta20Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:*11.0.3 beta21Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:*11.0.3 beta22Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:*11.0.3 beta23Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:*11.0.3 beta24Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:*11.0.3 beta25Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:*11.0.3 beta26Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:*11.0.3 beta27Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:*11.0.3 beta28Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:*11.0.3 beta29Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:*11.0.3 beta3Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta30:*:*:*:*:*:*11.0.3 beta30Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta31:*:*:*:*:*:*11.0.3 beta31Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta32:*:*:*:*:*:*11.0.3 beta32Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta33:*:*:*:*:*:*11.0.3 beta33Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta34:*:*:*:*:*:*11.0.3 beta34Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta35:*:*:*:*:*:*11.0.3 beta35Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta36:*:*:*:*:*:*11.0.3 beta36Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta37:*:*:*:*:*:*11.0.3 beta37Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:*11.0.3 beta4Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:*11.0.3 beta5Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:*11.0.3 beta6Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:*11.0.3 beta7Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:*11.0.3 beta8Vulnerablefrappe
cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:*11.0.3 beta9Vulnerablefrappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta18:*:*:*:*:*:* Versions 11.0.3 beta18 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta19:*:*:*:*:*:* Versions 11.0.3 beta19 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta2:*:*:*:*:*:* Versions 11.0.3 beta2 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta20:*:*:*:*:*:* Versions 11.0.3 beta20 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta21:*:*:*:*:*:* Versions 11.0.3 beta21 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta22:*:*:*:*:*:* Versions 11.0.3 beta22 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta23:*:*:*:*:*:* Versions 11.0.3 beta23 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta24:*:*:*:*:*:* Versions 11.0.3 beta24 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta25:*:*:*:*:*:* Versions 11.0.3 beta25 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta26:*:*:*:*:*:* Versions 11.0.3 beta26 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta27:*:*:*:*:*:* Versions 11.0.3 beta27 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta28:*:*:*:*:*:* Versions 11.0.3 beta28 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta29:*:*:*:*:*:* Versions 11.0.3 beta29 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta3:*:*:*:*:*:* Versions 11.0.3 beta3 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta30:*:*:*:*:*:* Versions 11.0.3 beta30 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta31:*:*:*:*:*:* Versions 11.0.3 beta31 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta32:*:*:*:*:*:* Versions 11.0.3 beta32 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta33:*:*:*:*:*:* Versions 11.0.3 beta33 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta34:*:*:*:*:*:* Versions 11.0.3 beta34 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta35:*:*:*:*:*:* Versions 11.0.3 beta35 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta36:*:*:*:*:*:* Versions 11.0.3 beta36 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta37:*:*:*:*:*:* Versions 11.0.3 beta37 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta4:*:*:*:*:*:* Versions 11.0.3 beta4 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta5:*:*:*:*:*:* Versions 11.0.3 beta5 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta6:*:*:*:*:*:* Versions 11.0.3 beta6 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta7:*:*:*:*:*:* Versions 11.0.3 beta7 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta8:*:*:*:*:*:* Versions 11.0.3 beta8 Vulnerable ·frappe
  • cpe:2.3:a:frappe:erpnext:11.0.3:beta9:*:*:*:*:*:* Versions 11.0.3 beta9 Vulnerable ·frappe

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    frappe unspecified

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23055
  2. 2026-10-03 Alias added: GHSA-gxgf-4cfv-cmq2

References

Exploit 3

  • TI-2026-28140 ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). CVSS 3.1CRITICAL 9.8
  • TI-2025-40873 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
  • TI-2025-40872 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
  • TI-2025-40871 A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext… CVSS 3.1CRITICAL 9.8
  • TI-2025-32462 In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at… CVSS 3.1HIGH 8.2
  • TI-2025-32461 In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at… CVSS 3.1HIGH 8.2
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences