Frappe ERPNext versions prior to 15.121.0 and 16.x prior to 16.34.0 lack proper authorization checks on several document‑creation endpoints. An authenticated user with limited privileges can send requests to these endpoints to create records for which they have no permission, effectively elevating their capabilities and violating role‑based access controls. The vulnerability directly compromises data integrity and confidentiality because sensitive records can be fabricated or duplicated without authorization.

The affected product is Frappe ERPNext. Users running any ERPNext deployment with a version older than 15.121.0 or any 16.x release older than 16.34.0 are impacted. No other vendors or product lines are listed.

The CVSS score of 7.1 places the flaw in the high‑severity category, indicating significant damage potential if exploited. EPSS data is not available, so no global exploit probability estimate can be provided, and the flaw is not in CISA’s KEV catalog. The likely attack vector is an authenticated internal user with network access to the application, capable of sending crafted HTTP requests to the vulnerable endpoints. No external exploitation or privilege escalation beyond the authenticated session is required, making the vulnerability readily exploitable in environments where local users retain network connectivity to the ERPNext instance.