Shohruh Yoldoshov

An authorization flaw exists in the whitelisted `get linked payments for doc()` method. Authenticated users, including those with portal access, can provide arbitrary values for the `company`, `doctype`, and `docname` variables to access Payment Ledger Entry allocation data belonging to invoices and vouchers of other companies.

An authorization flaw exists in the `get open activities()` function within `erpnext.crm.utils`. This issue allows any authenticated user, including those with portal access or no assigned roles, to access ToDo and Event records. By providing arbitrary values to the `ref doctype` and `ref docname` variables, an attacker can enumerate activities and retrieve private calendar event details.

Missing authorization in the whitelisted `get bom items()` and `get bom diff()` methods allows authenticated users, including those with portal or no-role access, to bypass BOM read permission checks. By calling `get bom items()` with a specific BOM name, an attacker can retrieve sensitive data including raw materials, quantities, rates, and costs.

An authorization flaw exists in the whitelisted `erpnext.buying.utils.get linked material requests()` method. The function fails to perform necessary document or company permission checks. Consequently, authenticated users, such as portal users or those without assigned roles, can provide item codes to retrieve open Purchase-type Material Requests associated with other companies.

An information disclosure issue exists in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call the `get projectwise timesheet data`, `get timesheet detail rate`, and `get timesheet` endpoints to enumerate and retrieve billable time logs, including project names, billing amounts, and work descriptions, without proper authorization checks.

An authorization failure exists in the 'GET /api/nodes' endpoint, which allows unauthenticated attackers to retrieve all navigation nodes. This can lead to the disclosure of restricted page names, URL paths, and internal URLs across all sites and languages.