A missing authorization check in certain status‑change endpoints of Frappe ERPNext allows authenticated low‑privileged users to modify records beyond the permissions granted to their role. This flaw permits unauthorized data alteration, effectively bypassing the intended role‑based access controls.

Frappe ERPNext versions prior to 15.110.0 and 16.x prior to 16.21.0 are affected. The vulnerability resides in the ERPNext product under the frappe:erpnext vendor.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires that the attacker already has an authenticated account with at least low privileges and is able to invoke the vulnerable endpoints. No external attacker can trigger the flaw without such an account, but once authenticated the attacker can alter status fields that should be protected by stricter authorization checks.