The vulnerability arises from missing authorization checks on certain ERPNext endpoints. Authenticated users can invoke these endpoints directly, accessing data that exceeds the permissions granted by their assigned role. This flaw allows lateral reading of sensitive organizational data, undermining confidentiality and potentially exposing personally identifiable information, financial records, or other confidential assets. The weakness is a classic example of improper authorization (CWE-862).

Frappe ERPNext versions before 15.121.0 and 16.x before 16.33.0 are affected by this issue. Systems running these releases should be reviewed to determine which endpoints lack proper role enforcement.

The CVSS score of 7.1 indicates a high severity vulnerability. Because an attacker needs only valid credentials to exploit it, the risk is significant for any organization with user accounts. No EPSS score is available and the flaw is not listed in the CISA KEV catalog. The likely attack vector is network-based; authenticated users can call the affected endpoints remotely, implying that compromised or malicious insiders can read data beyond their authorized scope.