4 matches found
CVE-2026-109376
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the gettimesheethtml method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hidetimesheets and project membership, so attackers can retrieve...
CVE-2026-109376
ERPNext versions 15.55.0 through 16.50.0 are susceptible to an incorrect authorization vulnerability in the get_timesheet_html method. The root cause is that the method validates Project read access but fails to verify project membership or the hide_timesheets setting. This allows authenticated p...
CVE-2026-109376 ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the gettimesheethtml method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hidetimesheets and project membership, so attackers can retrieve...
EUVD-2026-97874
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the gettimesheethtml method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hidetimesheets and project membership, so attackers can retrieve...