CVE-2026-109376: ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html

Q: Does enabling the hide_timesheets setting prevent exploitation?

No. The affected method ignores hide_timesheets when authorizing access.

Q: What access does an attacker need?

The attacker must be an authenticated portal user with Project read access. No user interaction is required.

Published Oct 12, 2026

Updated

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the gettimesheethtml method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hidetimesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.

Affected Software

1 affected component

Frappe ERPNext>=15.55.0<=16.50.0

Event History

Oct 12, 2026

CVE Published

via MITRE·08:55 PM

Data Sourced

via MITRE·08:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does enabling the hide_timesheets setting prevent exploitation?

No. The affected method ignores hide_timesheets when authorizing access.

What access does an attacker need?

The attacker must be an authenticated portal user with Project read access. No user interaction is required.

CVE-2026-109376: ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html

Affected Software

Event History

Frequently Asked Questions

Does enabling the hide_timesheets setting prevent exploitation?

What access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Does enabling the hide_timesheets setting prevent exploitation?

What access does an attacker need?