The vulnerability in Frappe ERPNext versions before 15.119.1, and in the 16.x series before 16.32.0, stems from missing authorization checks on specific endpoints. Authenticated users with low‑privilege roles can call these endpoints and alter documents and data that should only be reachable by higher‑level roles. This flaw can be used to modify business records, potentially leading to inaccurate transaction records, financial discrepancies, or other integrity‑related disruptions.

Vendor: Frappe. Product: ERPNext. Affected releases are all versions earlier than 15.119.1 and all 16.x releases prior to 16.32.0.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS data is not available, so the current likelihood of exploitation remains uncertain. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is Network, where an attacker who has valid low‑privilege credentials can send crafted requests to the vulnerable endpoints to bypass role checks and modify protected data.