The missing authorization flaw in Frappe ERPNext allows authenticated low‑privileged users to read personal data that is outside the scope of their assigned role. This results in an uncontrolled disclosure of sensitive information such as customer or employee details, directly violating confidentiality and potentially exposing the organization to privacy violations.

The vulnerability exists in all Frappe ERPNext installations prior to version 15.120.0 and in all 16.x releases earlier than 16.33.0. Any system running one of those releases without the published update is affected.

The CVSS score of 7.1 indicates moderate‑to‑high severity. EPSS data is not available, so the current likelihood of exploitation is undefined, but because the flaw only requires valid user credentials and no special conditions, it can be abused by anyone who has logged in. The issue is not yet listed in CISA’s KEV catalog, but the lack of a public exploit does not diminish the threat. Administrators should assume that the vulnerability can be leveraged for widespread data collection and plan accordingly.