CVE-2026-109376: ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html
Published Oct 12, 2026
·Updated
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the gettimesheethtml method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hidetimesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.
Affected Software
1 affected component
Frappe ERPNext>=15.55.0<=16.50.0
Event History
Oct 12, 2026
CVE Published
via MITRE·08:55 PM
Data Sourced
via MITRE·08:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does enabling the hide_timesheets setting prevent exploitation?
No. The affected method ignores hide_timesheets when authorizing access.
2
What access does an attacker need?
The attacker must be an authenticated portal user with Project read access. No user interaction is required.