CVE-2026-94113

MEDIUM 6.5

Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

CWE	CWE-862
Vendor	frappe
Product	erpnext
Published	Sep 20, 2026

Stay Ahead of the Next One

Get instant alerts for frappe erpnext

Be the first to know when new medium vulnerabilities affecting frappe erpnext are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Frappe / ERPNext

0 < 15.121.0 16.0.0 < 16.34.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/erpnext/security/advisories/GHSA-9vph-hqmm-g7hq github.com: https://github.com/frappe/erpnext/commit/c656497aac76af82eea028e3e8cb8d5380385f0f github.com: https://github.com/frappe/erpnext/commit/d5df40986d72a55d414ddaf4d382883f9df31e41 github.com: https://github.com/frappe/erpnext/pull/58576 vulncheck.com: https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-and-16.34.0-missing-authorization-in-timesheet-endpoints

Credits

Shohruh Yo'ldoshov