The vulnerability resides in Frappe ERPNext versions before 15.115.0 and 16.x before 16.26.0, where certain endpoints do not enforce proper authorization checks. Authenticated attackers with low‑privileged accounts can invoke these endpoints to read financial data that they are not permitted to see. This results in unauthorized disclosure of sensitive financial information, which can compromise confidentiality and potentially lead to financial loss or regulatory violations.

The affected system is Frappe ERPNext. The vulnerable versions are all releases prior to 15.115.0 and before 16.26.0 of the 16.x series.

With a CVSS score of 7.1 the vulnerability is considered moderate to high severity. The likely attack vector is internal or privileged, inferred from the requirement for a valid user account. EPSS data is not available. The vulnerability is not listed in the CISA KEV catalog, indicating no known large-scale exploitation. The lack of proper permission checks directly leads to data disclosure if an attacker can authenticate with a low‑privileged account.