The vulnerability is a missing authorization check on certain endpoints in Frappe ERPNext before version 15.121.0 and 16.x before 16.34.0. When authenticated users hit these endpoints they can modify records they are not authorized to change, thereby compromising the integrity of the system data. The weakness is a classic missing authorization flaw and does not directly involve confidentiality or availability.

This flaw affects Frappe ERPNext installations using versions before 15.121.0 and earlier 16.x releases prior to 16.34.0. Users of these specific versions should assess whether their deployment includes any of the affected endpoints.

The CVSS score of 5.3 indicates a moderate risk, though the EPSS score is not available for this vulnerability. It is not listed in CISA’s KEV catalog. The most likely attack vector, inferred from the description, is an authenticated user who exploits the missing checks to alter data beyond their permitted role. An attacker with valid credentials can therefore elevate functional privileges and alter critical business documents.