Certain API endpoints in ERPNext prior to version 16.9.1 fail to enforce proper authorization checks, allowing authenticated users to modify records that lie outside their permitted role boundaries. This flaw represents a serious breach of data integrity and confidentiality by enabling unauthorized changes to business documents. It is classified under CWE‑862, Improper Privilege Management, reflecting a failure to restrict operation access based on user roles.

All installations of ERPNext built on frappe:erpnext that are running any version earlier than 16.9.1 are affected. The issue was resolved in the 16.9.1 release; any deployment that has not upgraded to at least that patch level remains vulnerable.

The vulnerability carries a CVSS score of 9.9, marking it as critical. No EPSS score is currently available, and it is not listed in the CISA KEV catalog, but the lack of mitigations in earlier releases leaves a clear attack path. Because the flaw permits policy bypass via standard authenticated requests, an attacker only needs a legitimate user session—no elevated privileges or special conditions are required—to craft malicious updates through the web interface or API endpoints that lack proper role validation.