Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109376ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html

Medium 4.3

In plain English

A medium-severity incorrect authorization in ERPNext from Frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 83.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.

Affected products (as reported)

Vendor	Product	Versions
Frappe	ERPNext	15.55.0 – through 16.50.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Pull Request #60280 issue-tracking, patch
Patch Commit patch
Vulnerable code in projects.py technical-description
https://github.com/frappe/erpnext product
VulnCheck Advisory: ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html third-party-advisory