Frappe ERPNext includes missing authorization checks on several endpoints, allowing an authenticated user to retrieve financial data beyond the permissions granted by their role. The flaw permits disclosure of sensitive accounting information and transaction history, constituting a confidentiality breach that matches the CWE-862 access control weakness.

Frappé ERPNext installations running any version earlier than 15.121.3 or any 16.x release earlier than 16.35.0 are affected. The vulnerability resides in endpoints that fail to enforce role‑based authorization checks, exposing a subset of financial data to users who should not have access.

The CVSS score of 7.1 indicates a high risk level. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the exploitation vector is straightforward: an authenticated attacker can issue requests to the vulnerable endpoints and read restricted financial data. The difficulty of exploitation is low, and the impact is significant for organizations that rely on ERPNext for financial management.