CVE-2026-109376

Deferred Deferred - Pending Action

ERPNext Portal Users Unauthorized Timesheet Data Exposure

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109376

Affected Vendors & Products

Vendor	Product	Version / Range
Frappe	ERPNext	15.55.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

ERPNext versions 15.55.0 through 16.50.0 have an authorization flaw in the get_timesheet_html method. Authenticated portal users can view project timesheets even if they lack proper permissions. The method only verifies Project read access but ignores settings like hide_timesheets and project membership, allowing attackers to see timesheet names, status, dates, and last modifiers.

Detection Guidance

Check ERPNext logs for unauthorized access to timesheet data via the get_timesheet_html method. Monitor network traffic for suspicious API calls to this endpoint from portal users.

Impact Analysis

Attackers with portal access could exploit this to view sensitive timesheet data, including project details, employee work logs, and modification history. This may lead to data leaks, privacy violations, or unauthorized knowledge of internal project timelines and resource allocation.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by leaking employee time-tracking details. It undermines data protection requirements for confidentiality and access controls, potentially leading to regulatory penalties or loss of compliance certifications.

Mitigation Strategies

Upgrade ERPNext to a version beyond 16.50.0 where this vulnerability is fixed. Temporarily restrict portal user access to timesheet data until patched.

Hi! I’m here to help you understand CVE-2026-109376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70