A missing authorization check in certain ERPNext endpoints allows an authenticated user with low privileges to modify the status of records beyond what their role permits, leading to a compromise of data integrity.

The flaw affects Frappe ERPNext versions prior to 15.121.0 and 16.x versions prior to 16.34.0. Users deployed with these versions should verify their installation version and apply the vendor fix.

The CVSS score is 7.1, indicating a high impact if exploited and a moderate level of effort to craft an exploit. The EPSS score is not available, so the exploitation probability cannot be quantified, but similar weaknesses in widely used ERP systems are often actively abused. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated attacker who has successfully logged in with a low‑privilege role; the attacker can then invoke the vulnerable endpoints to change data. Proper role enforcement is required to neutralize this risk.