Published: October 12, 2026 | Last Modified: October 12, 2026
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.