Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 has a missing authorization flaw in several project‑related endpoints. The flaw allows an authenticated user with low‑privileged roles to access the endpoints without proper permission checks, resulting in the disclosure of project data that the user is not authorized to view. This vulnerability is classified under CWE-862, indicating a failure to enforce authorization controls.

The affected product is Frappe ERPNext. Versions prior to 15.111.0 and 16.x versions older than 16.22.0 contain the issue. Users running any of these releases should verify their installed version against the latest patch level.

The vulnerability has a CVSS score of 7.1, reflecting a moderate to high risk of data exposure. Since the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, exploitation is not currently known to be widespread. However, the attack path is straightforward: an attacker must be authenticated, which is often trivial in multi‑user environments, and can directly invoke the unprotected endpoints to retrieve sensitive project information.