The vulnerability is a missing authorization check in multiple ERPNext endpoints that expose valuation data. An authenticated user with a low-privilege role can query these endpoints and retrieve financial valuation information that should be restricted to higher‑privileged users. This flaw allows an attacker to gain confidentiality of proprietary financial data without compromising system integrity or availability.

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 are affected. The flaw resides in specific endpoints that handle valuation data and fail to enforce proper role‑based access controls.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with at least a low‑privilege role, making the attack vector likely to be an authenticated, legitimate user who is misusing unprotected API endpoints.