The vulnerability, located in the get_linked_material_requests function of the erpnext.buying.utils module, lacks necessary authorization checks for document and company access. Authenticated users, even those without roles or portal users, can provide arbitrary item codes and retrieve all open Purchase‑type Material Requests belonging to other companies. The flaw permits unauthorized disclosure of business‑critical procurement data and could facilitate further privileged actions if the information is used maliciously.

Affected systems include Frappe ERPNext deployments running a version earlier than 15.121.4 or any 16.x version prior to 16.36.0. These installations are exposed to the missing authorization issue. The issue is present in the public GitHub source code for these releases.

The CVSS score of 5.3 indicates a moderate impact, while the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. Because the flaw requires only an authenticated session and no special privileges, it can be exploited by any user who can log in to the ERP system. The lack of role checks means attackers can leverage portal accounts or users with minimal access to harvest material request data across company boundaries.