A missing authorization check allows authenticated low‑privileged users to change the status of documents on Frappe ERPNext. The vulnerability enables the attacker to manipulate data beyond their intended role, compromising data integrity and undermining the integrity of organizational controls. The weakness is a classic Example of Improper Authorization (CWE‑862).

Products affected are Frappe ERPNext, specifically any install version before 15.121.0 and any 16.x release prior to 16.34.0. Sites using those releases are susceptible to the unauthorized status changes identified in the advisory.

The CVSS base score is 7.1, indicating a medium to high severity. EPSS data is not available, so we lack precise exploitation probability, and the vulnerability is not currently listed in CISA KEV. Because the flaw requires an authenticated session, an attacker would need to compromise or use a legitimate low‑privileged account within the environment. Once access is achieved, the attacker can call the vulnerable endpoints to alter document statuses, potentially disrupting business processes or data consistency.