The vulnerability is a missing authorization flaw that permits authenticated users to read financial data beyond the permissions granted to their role. Attackers can query unsecured endpoints and retrieve account balances, transaction histories, and other sensitive financial records. The primary impact is a breach of confidentiality, potentially exposing corporate financial information to unauthorized personnel while leaving integrity and availability intact.

All installations of Frappe ERPNext versions before 16.34.0 are affected. The flaw exists in the ERPNext application code base and applies to the standard financial data endpoints exposed by the platform.

The CVSS score of 7.1 indicates moderate to high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires authentication; an attacker who can log in with any user account can exploit the missing checks. Exploitation is straightforward because the endpoints lack proper role validation, so an attacker can simply issue GET or LIST requests to view data they do not own.