ERPNext versions before 15.112.0 and 16.22.0 contain missing write permission checks in the functions merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center located in multiple source files. This omission allows authenticated users with limited privileges to perform unauthorized modifications to protected data, violating proper authorization controls (CWE-862). The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity due to low attack complexity and significant impact on integrity and availability. The issue is resolved in ERPNext versions 15.112.0 and 16.22.0.

Authenticated users with limited privileges can bypass authorization controls to modify protected data beyond their assigned roles. This can lead to unauthorized data manipulation affecting the integrity and availability of ERPNext systems. There is no indication of confidentiality impact. No known exploits in the wild have been reported.

Upgrade ERPNext to version 15.112.0 or later, or 16.22.0 or later, where this issue is fixed. Patch status is confirmed by the vendor advisory stating the fix in these versions. Until upgraded, restrict access to trusted users only and monitor for unauthorized changes related to the affected functions.