The vulnerability resides in the send_auto_email method of the Process Statement Of Accounts module, where no permission check is performed before sending emails. An authenticated user with even minimal privileges can trigger this function, sending unsolicited or sensitive account statements to arbitrary recipients. This bypasses normal access controls (CWE‑862) and can lead to data exposure, spamming, or phishing of customers.

The flaw affects ERPNext instances running the Frappe ERPNext platform with code versions older than 15.111.0 or 16.22.0. All releases prior to these specific tags, as referenced by the GitHub release notes and commits, are vulnerable. The issue was patched in the 15.111.0 and 16.22.0 releases.

With a CVSS score of 4.3 the severity is low to moderate, and no EPSS data is available, indicating a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread incidents. An attacker would need valid credentials for a user who has access to the Process Statement Of Accounts page, a capability often granted to low‑privilege accounts. The likely attack vector is internal or via compromised credentials, and the impact focuses on the integrity of business communications and potential data leakage.