The vulnerability allows an authenticated user with low‑privileged roles to deactivate master records through certain endpoints that fail to perform proper permission checks. Because the attack can lead to removal or inactivation of critical business data, it threatens the integrity of the system, potentially disrupting business processes and eroding data trust. The weakness is a classic example of missing authorization, classified under CWE‑862.

The flaw exists in Frappe ERPNext deployments running versions earlier than 15.108.0 and in the 16.x branch before 16.18.0. Any installation of these versions that exposes the affected endpoints to users with standard privileges is at risk.

With a CVSS score of 5.3, the vulnerability is considered moderate in severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting that no mass exploitation campaign is currently underway. Attackers would need valid credentials and access to the system, but the missing authorization check lowers the barrier for a low‑privileged user to perform the exploit.