A missing authorization flaw in Frappe ERPNext allows an authenticated user to call certain endpoints that return financial information not intended for their role. The vulnerability does not change the data but permits read access beyond the authorized scope, potentially exposing account balances, transaction histories, and other confidential financial records. The weakness is an example of improper access control (CWE‑862).

Vendor. Frappe, product ERPNext. The flaw affects all installations running versions prior to 15.113.0 and all 16.x releases before 16.24.0. The impacting endpoints are present in both 15.x and 16.x branches of the codebase.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score is not available, so the exploitation likelihood cannot be quantified. The CVE is not listed in the CISA KEV catalog. The likely attack vector is an authenticated attacker who has legitimate credentials but mis‑role privileges; no elevated privileges are required to exploit the missing checks.