Frappe ERPNext versions earlier than 15.120.0 and all 16.x releases prior to 16.33.0, contain an authorization oversight that allows authenticated users lacking sufficient privileges to call endpoints and retrieve financial information they should not be able to view. The flaw is a missing permission check, identified as CWE‑862, and facilitates read‑only data exfiltration.

Any deployment of the Frappe ERPNext application that has not been updated to at least version 15.120.0 or later, or any 16.x build earlier than 16.33.0, is vulnerable. The exposed endpoints return financial records and reporting data that should only be available to users with appropriate roles.

The CVSS score of 7.1 marks the issue as high severity. Because the bug can be triggered by any authenticated low‑privileged user and no special network or privilege escalation steps are required, exploitation probability is high in environments where such users exist. Although EPSS data is not available, the critical nature of the exposed financial data makes immediate remediation essential. The vulnerability is not yet listed in CISA's KEV catalog. The attack vector is likely through normal use of the application, and any user with read access can trigger the endpoint calls.