CVE-2026-94113
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.
Risk Assessment
The risk includes unauthorized access to sensitive time and billing data, which could compromise the confidentiality of business information.
Recommendation
It is recommended to immediately upgrade ERPNext to version 15.121.0 or 16.34.0, and to enforce access controls on timesheet endpoints.
Other vulnerabilities in Frappe ERPNext
See all- CVE-2026-96672Medium
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.
- CVE-2022-28598Medium
Frappe ERPNext version 12.29.0 is vulnerable to XSS attacks. The software does not neutralize or incorrectly neutralizes user-controllable input before placing it in output used as a web page served to other users.
Original NVD description (English source)
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.