Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 contain a server‑side request forgery flaw. A configuration field that can be written by common operational roles accepts an arbitrary URL without validation, allowing authenticated attackers to instruct the server to issue outbound HTTP requests to any destination. This lack of validation enables attackers to reach internal hosts or services that are otherwise unreachable from the external network, potentially exposing sensitive data or facilitating further attacks.

The vulnerability affects the whole Frappe ERPNext application. Versions earlier than 15.112.0 of branch 15, and versions earlier than 16.23.0 of branch 16, are susceptible. Users should check their deployment version and plan an upgrade accordingly.

The CVSS score is 5.3, indicating a medium severity SSRF. The exploit requires authentication with any role that can modify the configuration field, a capability commonly granted to operational staff. Although the EPSS score is not available, the nature of the bug suggests that exploitation is easy once access is gained. The vulnerability is not listed in CISA KEV, but its potential to reach internal networks warrants timely mitigation.