CVE-2022-23055

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.

• CWE-862

• https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134Exploit, Third Party Advisory
• https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155Exploit, Third Party Advisory
• https://www.mend.io/vulnerability-database/CVE-2022-23055Exploit, Patch, Third Party Advisory
• https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134Exploit, Third Party Advisory
• https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155Exploit, Third Party Advisory
• https://www.mend.io/vulnerability-database/CVE-2022-23055Exploit, Patch, Third Party Advisory

Published

Jun 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2305The WordPress Popup WordPress plugin through 1.9.3.8 does no…4.8
• CVE-2022-23050ManageEngine AppManager15 (Build No:15510) allows an authent…7.2
• CVE-2022-23051PeteReport Version 0.5 allows an authenticated admin user to…5.4
• CVE-2022-23052PeteReport Version 0.5 contains a Cross Site Request Forgery…6.5
• CVE-2022-23053Openmct versions 1.3.0 to 1.7.7 are vulnerable against store…6.1
• CVE-2022-23054Openmct versions 1.3.0 to 1.7.7 are vulnerable against store…6.1
• CVE-2022-23056In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vu…
• CVE-2022-23057In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stor…5.4
• CVE-2022-23058ERPNext in versions v12.0.9-v13.0.3 are affected by a stored…
• CVE-2022-23059A Stored Cross Site Scripting (XSS) vulnerability exists in …4.8
• CVE-2022-2306Old session tokens can be used to authenticate to the applic…7.5
• CVE-2022-23060A Stored Cross Site Scripting (XSS) vulnerability exists in …4.8