Frappe applications lacking authorization checks in certain endpoints allow authenticated users to alter records beyond their assigned permissions, effectively bypassing role‑based restrictions. This flaw permits internal actors with valid credentials to modify data they should not have access to, compromising data integrity and potentially enabling further lateral movement within the application. The underlying weakness corresponds to improper authorization enforcement (CWE‑862).

The vulnerability impacts Frappe platform versions prior to 15.113.3 and before 16.25.0. Users running any of these releases should verify their deployment version and upgrade to at least 15.113.3 or 16.25.0, where the missing authorization checks have been addressed.

The flaw scores a CVSS of 5.3, indicating moderate overall risk with potential for data integrity compromise. No EPSS score is currently available, and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated access; an attacker must possess valid credentials that provide any role, but the endpoint then elevates privileges to modify records beyond role constraints. Given the absence of a known public exploit and moderate scoring, organizations should treat this as a medium‑severity issue and prioritize patching.