The vulnerability arises from missing authorization checks on the Sales Person-wise Transaction Summary report endpoints, allowing authenticated users with limited roles to retrieve financial transaction rows that exceed their permission boundaries. This results in a confidentiality compromise where unauthorized personnel can read sensitive financial data. The weakness is identified as Missing Authorization (CWE-862).

The affected product is ERPNext from the frappe:erpnext vendor. Versions older than 15.118.0 in the 15.x major line and older than 16.27.0 in the 16.x line are vulnerable. Deployments of these earlier releases might expose internal financial records to unauthorized staff.

The CVSS score is 6.5, indicating a moderate severity. Exploitation requires an authenticated user within the application, so it is an internal or remote authenticated vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a role‑limited authenticated user accessing the affected endpoint; once accessed, the user can read financial data beyond their permitted role.