The vulnerability arises because several document‑retrieval endpoints in ERP Next fail to perform proper access validation. An attacker can request any document identifier and receive the associated file, enabling the disclosure of confidential business data. The weakness is rooted in missing authentication and authorization checks, as described by the CWE identifiers for improper authorization and lack of authentication, which allows an unauthenticated user to read protected resources.

The issue affects the frappe:erpnext product. Vulnerable installations include all releases up to and including 15.98.0, 16.0.0‑rc.1, and 16.6.0. Fixes are available in 15.98.1, 16.6.1, and later versions.

The CVSS score of 9.3 denotes a critical severity, but the EPSS score of less than 1% suggests that exploitation is currently rare and may require deliberate targeting. The vulnerability is not listed in CISA’s KEV catalog, so no known public exploits have been reported. An attacker can exploit the flaw remotely by sending HTTP requests to the affected endpoints without any authentication, provided the target uses a vulnerable version. The high severity combined with low exploitation probability points to a moderate overall risk that still demands remediation.