ERPNext released prior to versions 15.121.0 and 16.34.0 exposes several endpoints that allow status changes without performing the required authorization checks. A user who authenticates with a low‑privilege role can invoke these whitelisted methods and modify data beyond the role’s permitted scope, potentially altering critical business information. The weakness is classified as Missing Authorization (CWE‑862) and compromises data integrity for affected users.

The vulnerability affects the ERPNext suite provided by frappe:erpnext. Any installation running a version earlier than 15.121.0 or 16.34.0 is susceptible. Verification of the installed version against the product release timeline is necessary to determine exposure.

The CVSS score of 7.7 indicates a high‑severity impact. External penetration testing evidence is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits. The attack vector is inferred to be authenticated, as the attacker must have a valid user account with a low‑privileged role. By calling the exposed API endpoints, an attacker can change document states, leading to tampering of business records. The overall risk remains significant until the patch is applied.