Frappe ERPNext releases before 15.118.0 and 16.x releases before 16.27.0 contain a missing authorization flaw in several endpoints. The flaw allows any authenticated user to request data that should be restricted by their role, so an attacker can read financial records that are beyond the user’s legitimate permissions. The vulnerability does not change the attacker’s privileges, but grants broader visibility into confidential business data, compromising confidentiality and potentially enabling downstream fraud or insider threats.

The affected products are Frappe ERPNext. Versions upstream of 15.118.0 and 16.x releases prior to 16.27.0 are impacted by this missing authorization check. The vulnerability is specifically tied to ERPNext’s role‑based access controls; users assigned any role can exploit the exposed endpoints if the application version falls in the listed ranges.

The CVSS score of 7.1 indicates a medium severity that is significant for data protection. The EPSS score is not available, so the current public probability of exploitation cannot be quantified, but the flaw is listed in the vendor advisories and could be leveraged by any authenticated user. The issue is not yet included in the CISA KEV catalog. Attackers need only valid credentials and then can query the exposed endpoints; no elevated privileges or special network conditions are required. Based on the description, it is inferred that the likely attack vector is standard authenticated HTTP requests to the vulnerable API or UI routes.