A missing authorization check in Frappe ERPNext allows an authenticated user with a common operational role to modify records that should be out of reach. The flaw enables the alteration of fields on record types beyond the user’s permitted scope, providing a vector for tampering with critical data. The vulnerability is limited to authenticated users, so it does not permit unauthenticated access, but still lets legitimate users subvert security boundaries.

The issue affects installations of Frappe ERPNext version 15.111 and earlier. Any deployment running a version before 15.112.0 is susceptible to this unauthorized record modification.

The CVSS score of 5.3 indicates a moderate severity. Exploitation requires an authenticated session with a standard role; no public exploit is reported and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is internal and requires user credentials, the overall risk depends on the distribution of privileged roles. Adopting the CVSS score and the missing EPSS value suggests that the likelihood of an unsanctioned attack is moderate; however, organizations with broad operational role assignments should consider this a high priority for containment.