CVE-2026-109376

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the gettimesheethtml method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hidetimesheets and project membership, so attackers can retrieve...