Description
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Frappe | ERPNext | 15.55.0 – ≤ 16.50.0 | — |
References
- GitHub Pull Request #60280 issue-tracking patch
- Patch Commit patch
- Vulnerable code in projects.py technical-description
- https://github.com/frappe/erpnext product
- VulnCheck Advisory: ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html third-party-advisory