The vulnerability is a missing authorization flaw that allows authenticated users with low privilege to access item master data they are not permitted to see. This flaw directly undermines the confidentiality of business information stored in ERPNext. The weakness is classified as CWE‑862: Missing Authorization.

Frappe ERPNext versions before 15.118.2 and all 16.x releases before 16.30.0 are affected. Users of these versions are at risk if they have any low-privileged authenticated accounts.

The CVSS score of 7.1 indicates a fairly high severity with moderate exploitation complexity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploit activity at the time of analysis. The attack vector requires an authenticated user within the application, so the attacker must already have valid credentials but does not need higher privileges. Once authenticated, the attacker can call the vulnerable endpoints to read data beyond role limits.