CVE-2026-109376 ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the gettimesheethtml method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hidetimesheets and project membership, so attackers can retrieve...