In ERPNext 9.0.0 through 16.50.0, certain batch lookup methods lack the necessary authorization checks. Authenticated users, including those accessing the customer portal, can invoke get_batch_qty, get_batches_by_oldest, or get_pos_reserved_batch_qty to retrieve per-warehouse quantities for every batch item. This flaw results in the unintended exposure of inventory data, providing attackers with sensitive operational information that could be used for competitive analysis, inventory manipulation or further social engineering attacks. The weakness corresponds to an authorization bypass (CWE-862).

The affects Frappe's ERPNext product, specifically all releases from 9.0.0 up to and including 16.50.0. No other vendors or product variants are listed.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. The attack vector requires authentication, which means that an attacker must first compromise valid user credentials—often achieved through phishing, credential reuse, or exploitation of a customer portal login. Once authenticated, the attacker can immediately request the vulnerable methods and obtain full inventory visibility.