[ CVE-2026-109376 · Published 12 Oct 2026 ]
Vulnerability in Frappe ERPNext
CVSS 4.3
EPSS <1%No fix listed yet
[ Description ]Official description
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.