The vulnerability arises from missing authorization checks on several endpoints in Frappe ERPNext versions before 15.110.0 and in the 16.x series prior to 16.21.0. Authenticated users can send requests to these endpoints and read data that exceeds the permissions granted by their assigned role. This flaw enables an attacker who has basic credentials to obtain confidential information that should be restricted to higher‑privilege users, effectively exposing sensitive business data while leaving application control intact.

This issue impacts the Frappe ERPNext product. Customers running any build of the 15.x line older than 15.110.0, as well as 16.x releases before 16.21.0, are affected. The implicated endpoints are not specified in the advisory, but the affected releases are clearly identified by the advisory.

The CVSS score of 5.3 reflects a moderate level of risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread exploitation has been reported. Attackers would need to be authenticated to exploit the flaw, thus the threat primarily targets compromised or poorly protected accounts. No publicly disclosed exploit code is known, but the absence of enforcement makes the vulnerability predictable for anyone who can log in.