CVE-2026-94113
Deferred Deferred - Pending Action

Information Disclosure in Frappe ERPNext

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulnCheck

Description
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94113
EUVD
EUVD-2026-83735

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
frappe erpnext to 16.34.0 (exc)
frappe erpnext to 15.121.0 (exc)
frappe erpnext From 16.0.0 (inc) to 16.34.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0. Authenticated attackers can exploit whitelisted timesheet endpoints like get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet to access billable time logs, project names, billing amounts, and work descriptions without proper authorization checks.

Detection Guidance

Check ERPNext logs for unauthorized access attempts to timesheet endpoints like get_projectwise_timesheet_data, get_timesheet_detail_rate, or get_timesheet. Monitor for unusual data retrieval patterns or queries involving project names, billing amounts, or work descriptions without proper authorization.

Impact Analysis

Unauthorized users can view sensitive timesheet data including project details, billing information, and work descriptions. This could lead to data leaks, financial information exposure, or competitive disadvantages if proprietary project data is accessed.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing sensitive personal or financial data without proper authorization. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade ERPNext to version 15.121.0 or 16.34.0 or later. Apply the security patches from the official repository commits (d5df409 or c656497) to enforce proper scoping in timesheet endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94113. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart