Frappe ERPNext prior to version 15.121.0 and versions prior to 16.34.0 have a missing authorization flaw that allows authenticated users to call certain API endpoints and retrieve data that exceeds their defined role permissions. The flaw stems from inadequate permission checks on these endpoints, making it possible for an attacker who already has a user account to read privileged information such as financial records, customer data, or internal configurations. This enables direct data exposure and potential further lateral movement if sensitive information is obtained.

The vulnerability affects the Frappe ERPNext application from all vendors identified as frappe:erpnext. Users running any affected instance of the ERPNext application before version 15.121.0 or before the 16.34.0 update are susceptible. No specific sub‑product or module is excluded; all endpoints that require proper role validation are impacted.

The risk level is moderate, reflected in a CVSS score of 5.3, and the issue is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploitability requirement is that the attacker is authenticated; no public vulnerability exists to bypass authentication. The EPSS score is not available, so the current probability of a public exploit is unclear. The best guess for an attack vector is an authenticated user with compromised credentials or social engineering to gain access, after which they can call the vulnerable endpoints to harvest data beyond their authorized scope.