Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 allow an authenticated user to call a transactional email endpoint without performing an authorization check. The caller can specify any recipient list and message content, resulting in emails that appear to originate from the organization’s configured outgoing account. This flaw enables any user with login credentials to send phishing, spam, or defacement emails on behalf of the organization, potentially compromising reputational integrity and increasing the likelihood of credential harvesting or malicious domain utilization.

Products affected are the open‑source ERPNext platform supplied by Frappe. All releases prior to version 15.121.3 and releases of the 16.x line prior to 16.35.0 contain the vulnerability. The issue is present in the core transactional email API exposed by the ERPNext framework and does not depend on additional plug‑ins.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is currently documented. The attack vector requires an authenticated session; therefore an attacker must first compromise user credentials or have legitimate access. Once authenticated, the attacker can exploit the missing access control to impersonate the organisation in outbound messages.