This vulnerability allows authenticated users to modify data beyond the permissions of their assigned roles due to missing authorization checks on certain endpoints. The affected endpoints accept data modification requests without verifying that the caller’s role permits the requested changes. Consequently, an attacker with any valid user account can perform unauthorized updates, resulting in integrity violations and potential data corruption.

The affected product is Frappe ERPNext. Versions before 15.121.3 and all 16.x releases prior to 16.35.0 contain the flaw. The vulnerability resides in the trusted‑ed endpoints of the web application. Updating to 15.121.3, 16.35.0, or later removes the authorization defect.

The CVSS score of 7.1 indicates a high severity risk. The EPSS score is not available, so the precise exploitation likelihood is unknown, but the attack is straightforward for any authenticated user. The vulnerability is not listed in the CISA KEV catalog. An attacker needs valid credentials and can exploit the flaw by sending crafted HTTP requests to the vulnerable endpoints.