This vulnerability arises from missing authorization checks on several ERPNext endpoints, which allows authenticated users to modify documents that should be outside their permitted roles. Because the system relies on role-based access control, the flaw effectively permits users to tamper with critical business data, leading to integrity violations and potential downstream business process disruption. The weakness is classified as CWE-862, indicating improper authorization.

The affected product is the ERPNext application developed by the Frappe framework. Versions prior to 15.102.0 and 16.11.0 are vulnerable. Users running any of these releases are at risk unless they patch to the mentioned fixed releases or later.

The CVSS base score is 5.9, characterizing a moderate level of risk. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited publicly known exploitation. However, because any authenticated user with a role lower than administrator can invoke the affected endpoints, the likelihood of exploitation remains significant in environments where internal users have broad permissions or where remote administration is possible. Immediate patching is recommended to eliminate the risk.