A flaw in certain endpoints of Frappe ERPNext allows an authenticated user with low privileges to alter production records that are outside their authorized scope. The vulnerability stems from missing authorization checks, enabling the user to bypass role restrictions and modify critical data. This leads to a breach of data integrity and potential disruption of business processes.

The affected products are Frappe ERPNext versions prior to 15.112.0 and 16.x prior to 16.23.0. Users running these versions are at risk if they have any authenticated accounts that can reach the vulnerable endpoints.

The CVSS score of 7.1 classifies the vulnerability as medium to high severity. Although the EPSS score is not available, the lack of a KEV listing suggests no widespread exploitation is currently documented. Attackers would need to be authenticated, so the attack vector is internal or lateral and the exploitation requires access to the application. The vulnerability allows unauthorized modification of key production data, potentially compromising data integrity and availability.