Before 16.17.4, any authenticated user can invoke update_onboarding_step to modify any field of any Onboarding Step record. This IDOR flaw permits privilege escalation, allowing attackers to tamper with onboarding data, compromising data integrity and potentially exposing sensitive configuration details. The weakness is a classic example of improper authorization (CWE-284).

The flaw affects installations of the Frappe framework running versions earlier than 16.17.4. Any deployment using this framework is susceptible, as no vendor restriction is applied to the update interface.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is below 1%, suggesting a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires an authenticated user with access to the application; no publicly exposed remote vector is indicated in the description.