CVE-2026-109376: Incorrect Authorization in Frappe ERPNext
Description
ERPNext versions 15.55.0 through 16.50.0 contain an authorization vulnerability in the get_timesheet_html method. Authenticated portal users can view project timesheets without proper checks for hide_timesheets settings or project membership. This allows unauthorized access to timesheet details such as names, status, time-log dates, and last modifiers.
CVSS v4.0
Score 5.3medium
Affected software
Frappe
ERPNext
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109376 is an incorrect authorization vulnerability in ERPNext affecting versions 15.55.0 through 16.50.0. The vulnerability exists in the get_timesheet_html method, which only verifies Project read access but does not enforce restrictions based on hide_timesheets flags or project membership. As a result, authenticated portal users can access sensitive timesheet information they should not be authorized to view.
Potential Impact
Unauthorized authenticated portal users can access detailed project timesheet information, including timesheet names, status, time-log dates, and last modifiers. This exposure may lead to information disclosure but does not allow modification or privilege escalation based on the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict portal user access or monitor for unauthorized timesheet access as a precaution.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:23:25.691Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd4b442cdf04f656d3ef59
Added to database: 10/12/2026, 21:04:04 UTC
Last enriched: 10/12/2026, 21:34:17 UTC
Last updated: 10/12/2026, 21:34:17 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.