A crafted request to a specific ERPNext endpoint could cause the server to issue an HTTP call to an arbitrary service chosen by an attacker. This Server‑Side Request Forgery allows an authenticated user to access internal or external resources, potentially exposing confidential data or enabling lateral movement within the network. The vulnerability does not directly grant code execution, but it can be leveraged to enumerate network hosts, extract secrets, or pivot to other systems.

ERPNext, developed by frappe, was vulnerable in all releases before 15.106.0 and 16.16.0. Any authenticated user could exploit this flaw. The fix was introduced in the stated versions, so all deployments running older versions are affected. The tool is open‑source and widely deployed in small‑to‑medium enterprises and internal environments.

The CVSS score of 5.0 indicates a moderate risk level. No EPSS value is available, so the likelihood of exploitation cannot be quantified from the data. The flaw is not listed in CISA’s KEV catalog. Based on the description, the most likely attack vector is line‑of‑sight through the vulnerable HTTP endpoint, requiring authentication but not privileged roles.