The identified issue is a broken access control flaw in ERPNext’s Accounts Receivable and Accounts Payable reports. The ReceivablePayableReport prepare_conditions routine incorrectly omits permission checks for the Customer and Supplier user permissions on the dynamic‑link field that identifies the party. As a result, any authenticated user can invoke the report and retrieve financial details belonging to other companies. The consequence is an unprivileged information disclosure that could reveal revenue, outstanding balances, and transaction histories across organizational boundaries.

This weakness applies to the frappe:erpnext platform, specifically any installations running versions prior to 15.112.0 and 16.23.0. Upgrading to v15.112.0 or v16.23.0 and later incorporates the fix that enforces the proper permission checks on the party field.

The CVSS score for this vulnerability is 7.1, indicating moderate to high risk. Because the issue is triggered by any authenticated user and no special network access or local privilege escalation is required, the likelihood of exploitation in environments where users are logged in is significant. The EPSS score is unavailable, and it is not listed in the CISA KEV catalog, but the straightforward attack path—log in, request the affected report endpoint, and receive cross‑company data—makes it a practical threat in multi‑tenant deployments.