Frappe ERPNext versions earlier than 16.22.0 have a missing authorization flaw that permits an authenticated user to call endpoints without proper checks, enabling them to modify records beyond their authorized role. The vulnerability can lead to data integrity violations, potentially compromising sensitive business information. The weakness maps to CWE-862, which describes improper authorization controls that allow users to perform actions they are not entitled to.

Frappe ERPNext, versions prior to 16.22.0 are affected. Users of earlier releases must verify that they are not running these vulnerable versions.

The CVSS base score of 7.2 indicates a high severity risk. While the EPSS score is not available, the lack of a KEV listing suggests moderate exploitation likelihood. Likely attackers are authenticated users who can abuse the missing checks to alter data; no external access is required, but user privilege is a prerequisite. The vulnerability remains exploitable until the product is upgraded to a fixed release.