Executive brief
Frappe ERPNext is an open-source ERP system that tracks employee timesheets and project billing. Authenticated users can bypass permission checks on timesheet endpoints to view sensitive billing data—including project names, billable hours, and work descriptions—from other users or projects they should not have access to. This could lead to exposure of confidential billing information and project details.
Technical details
Whitelisted timesheet methods (get_projectwise_timesheet_data, get_timesheet_detail_rate, get_timesheet) fail to enforce doctype-level permissions, allowing authenticated attackers to enumerate and retrieve timesheet records without proper authorization. The vulnerability requires authentication but no additional user interaction; the fix scopes query results to projects and timesheets accessible to the authenticated user.
Affected products
- Frappe ERPNext before 15.121.0 and 16.x before 16.34.0
Timeline
- 2026-09-20: disclosed
- 2026-08-30: patched: fix committed to repository