The vulnerability is a missing authorization flaw in ERPNext's inventory record endpoints that allows authenticated users to modify inventory data beyond their permitted role. This can lead to integrity compromise of stock levels, invoices, and financial reports. The underlying weakness corresponds to CWE‑862, unauthorized access.

All ERPNext installations running versions prior to 15.110.0 or 16.x prior to 16.21.0 are affected, regardless of deployment environment. The flaw appears in the vendor's ERPNext product released by frappe.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the impact remains significant because any user with legitimate credentials can exploit it. The likely attack vector is that an attacker with user credentials, or who compromises them, can send crafted requests to inventory endpoints. The flaw does not require prior elevated privileges beyond authenticated access.