Certain endpoints within Frappe ERPNext versions earlier than 15.112.0 and 16.x releases prior to 16.23.0 fail to perform proper authorization checks. An authenticated user with a low‑privileged role can request personal data that should be restricted to higher‑privilege roles, resulting in confidential information leakage. This weakness is identified as CWE‑862, Missing Authorization.

The flaw targets installations of ERPNext provided by frappe running any release series below 15.112.0 or 16.x before 16.23.0. The vulnerability is specific to endpoints that serve user profile and personal data, where role‑based restrictions are incorrectly bypassed.

The CVSS v3.1 score of 7.1 indicates a high severity. Exploitation requires an authenticated account, so the threat depends on an attacker gaining any low‑privileged credentials. EPSS data is not available and the vulnerability is not listed in CISA KEV, suggesting no known public exploit but a significant risk if an attacker obtains legitimate access.