Frappe ERPNext before 15.105.0 (and 16.x before 16.15.0) contains a missing authorization flaw in certain document creation endpoints. The flaw permits any authenticated portal user to create documents on behalf of parties other than their own, potentially allowing data fabrication, integrity violations, and privilege escalation within the application.

The vulnerability affects all installations of ERPNext deployed with versions prior to 15.105.0 and 16.x prior to 16.15.0 when exposed to portal users that can access the vulnerable endpoints. This includes any production or development environment running those affected releases.

With a CVSS score of 5.3, the vulnerability is considered moderate in severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploitation at the time of this analysis. However, the attack vector requires an authenticated portal user with access to the document creation endpoints, which can be readily satisfied in many business scenarios. Consequently, the risk is chiefly driven by the number and privileges of portal users and the sensitivity of the data that may be created or modified.