CVE-2026-109376

ERPNext versions 15.55.0 through 16.50.0 are susceptible to an incorrect authorization vulnerability in the get_timesheet_html method. The root cause is that the method validates Project read access but fails to verify project membership or the hide_timesheets setting. This allows authenticated p...