Description
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | erpnext | < 15.119.1, 16.0.0-beta.1 – < 16.32.0 | 15.119.1 |