PT-2026-110925 · Frappe · Erpnext
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get timesheet html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Erpnext