Frappe ERPNext versions before 16.14.0 contain a missing authorization flaw that lets authenticated users alter master data records beyond the scope of their role. This weakens data integrity by permitting unauthorized changes to critical business information such as product definitions, pricing, and customer data. The flaw arises from certain API endpoints that omit proper permission checks, enabling an attacker who has legitimate access to send crafted requests to modify master data.

The vulnerability affects the ERPNext product from the Frappe framework in all releases prior to 16.14.0. Users running any 16.x or earlier version of ERPNext are at risk if they rely on the default role‑based access controls for master data management.

The CVSS score of 7.1 indicates a high impact with medium to high exploitation likelihood. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, suggesting no widespread public exploitation yet. The attack vector is inferred to be an authenticated user with legitimate credentials who can send requests to the vulnerable endpoints, exploiting the absence of proper authorization checks. No additional conditions such as remote code execution or privilege escalation are reported, so the risk is confined to data integrity violations.