Frappe ERPNext versions prior to 15.121.0 and 16.0.0 up to but not including 16.34.0 contain an information disclosure vulnerability due to missing authorization checks in certain whitelisted timesheet API endpoints. Authenticated users can invoke get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve sensitive information such as project names, billing amounts, and work descriptions without enforcing doctype permissions.

An authenticated attacker can access sensitive billing and project time log information without proper authorization. This could lead to unauthorized disclosure of confidential business data related to projects and billing, potentially impacting confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints to trusted users only and monitor for suspicious activity involving timesheet data retrieval.