ERPNext's functions such as merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center lack necessary write permission checks in files account.py, process_payment_reconciliation.py, purchase_invoice.py, and utils.py. This omission allows any authenticated user, even with limited roles, to alter protected master data, breaching confidentiality and integrity. The weakness is a classic missing access control flaw (CWE‑862).

This flaw exists in ERPNext releases before v15.112.0 and before v16.22.0. Organizations running those versions face a risk of data tampering by authorized users. The vulnerability spans critical accounting modules across erpnext/accounts/doctype/account, process_payment_reconciliation, purchase_invoice, and their utilities.

The CVSS score is 7.1, indicating a moderate to high severity. Since EPSS is not available, the historical exploitation probability is unknown; however, the vulnerability requires only normal authentication, meaning any user with access could attempt the attack. Because the flaw is inherent in core functions, no special environment is needed, and administrators should treat it as a high-priority remediation. The vulnerability is not listed in CISA KEV, but its potential impact on financial data warrants immediate attention.