The vulnerability in Frappe ERPNext allows authenticated users who possess insufficient privileges to create new records and alter data beyond their intended role by exploiting endpoints that do not enforce proper authorization checks. This flaw is classified under Missing Authorization (CWE‑862). As a result, an attacker can gain unauthorized access to sensitive data and modify system state without permission, potentially compromising data integrity and confidentiality.

The issue affects Frappe ERPNext versions prior to 15.119.0 as well as 16.x releases before 16.31.0. Users running these specified releases should verify their current version and determine whether they are within the vulnerable range.

The CVSS score is 7.1, indicating a medium to high severity. There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog. Attacks require the attacker to have valid authenticated credentials but with a role that is not intended to perform the offending operations. Once authenticated, the attacker can directly call the vulnerable endpoints to create or modify records, circumventing the application’s intended role‑based access controls. This makes exploitation relatively straightforward for an attacker with legitimate credentials who can manipulate privileged actions.