The vulnerability is a missing authorization check in the get_linked_payments_for_doc function. Any authenticated user, including portal users, can call the method by supplying arbitrary values for company, doctype, and docname. The function then returns the allocation data for payment ledger entries, allowing a user to read sensitive financial information that belongs to other companies or customers. This exposure violates the confidentiality of financial records and can be used for insider threats or data theft.

Frappe ERPNext versions prior to 15.121.4 and 16.x versions before 16.36.0 are affected. The flaw applies to all installations that expose the get_linked_payments_for_doc API to authenticated users, including those who authenticate through the standard portal UI.

The CVSS score of 5.3 classifies the vulnerability as moderate severity. While no EPSS score is available, the lack of a KEV listing suggests that widespread exploitation has not been reported. The attack vector requires authentication, but the method is accessible to all authenticated users, so the risk is largely internal or from compromised credentials. An attacker can harvest payment ledger data without needing code execution or additional privileges, making the vulnerability attractive for organizations with weak access controls or exposed credentials.