An Improper Authorization flaw allows the erpnext.crm.doctype.prospect.prospect.get_opportunities API endpoint to be called without proper access checks, enabling unauthorized users to retrieve prospect opportunity data. The defect is coded as CWE-862 and can expose confidential customer information that is normally protected by role-based permissions. The issue exists in ERPNext installations running a version before 16.26.0 (for the v16 series) and before 15.115.0 (for the v15 series), meaning that many actively deployed systems are vulnerable.

ERPNext software from the vendor Frappe is affected. The vulnerability applies to all instances deployed with ERPNext version 16.x prior to 16.26.0 and all instances running ERPNext 15.x older than 15.115.0. The flaw is present regardless of operating system — the vulnerability description lists Linux, macOS, and Windows as affected platforms via the cpe list. The specific REST endpoint is the whitelisted get_opportunities method within the prospect doctype module.

The CVSS base score of 7.1 labels the weakness as high severity. Because the EPSS score is not available, there is no hard metric indicating the likelihood of exploitation at this time. Nonetheless, the lack of access control permits an attacker to target the get_opportunities API directly, which is a standard HTTP request to the ERPNext backend; the attack could be performed by anyone who can reach the server, potentially even without valid credentials if the system does not enforce authentication. The flaw is not listed in the CISA KEV catalog, so there are no publicly documented exploits yet, but the absence of mitigation makes the vulnerability a high-risk exposure for organizations that expose their API to untrusted networks.