Threats affecting pkg:github/ERPNext

ERPNext versions 9.0.0 through 16.50.0 have a missing authorization vulnerability that allows authenticated users, including customer portal users, to access stock quantity information via certain whitelisted batch methods. This exposure enables attackers to list item batches with per-warehouse quantities without proper permission checks.

ERPNext versions 15.55.0 through 16.50.0 have an authorization vulnerability in the get_timesheet_html method. Authenticated portal users can view project timesheets without proper checks for hide_timesheets or project membership. This allows unauthorized access to timesheet details such as names, status, time-log dates, and last modifiers.

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.

CVE-2026-94113 is an information disclosure vulnerability in Frappe ERPNext affecting versions before 15.121.0 and 16.x before 16.34.0. The flaw exists in whitelisted timesheet endpoints that do not enforce doctype permissions, allowing authenticated attackers to access sensitive billable time log data without proper authorization.