Frappe ERPNext versions before 15.121.0 and the 16.x series before 16.34.0 have a missing authorization flaw that allows any authenticated user to call specific endpoints and alter data beyond the permissions granted for their role. The vulnerability arises from an absent or incorrect enforcement of role checks, an instance of missing authorization (CWE-862). This defect can lead to integrity violations, allowing attackers to tamper with records, transactions, or configuration that they should not have access to.

The affected product is Frappe ERPNext. All releases up to but not including 15.121.0 and 16.x releases older than 16.34.0 are vulnerable. No later versions are known to be impacted.

The CVSS score of 5.3 indicates a medium severity risk. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be authenticated to the application. Once logged in, a malicious user can readily invoke the vulnerable endpoints and cause unauthorized data changes. Because the flaw does not require additional conditions, the risk is real for installations that expose these endpoints to authenticated users without further segmentation.