CVE-2026-109376mediumCWE-863

CVE-2026-109376: falha de média gravidade em Frappe ERPNext

ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar erpnext

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Frappe · ERPNext
CVEs relacionadas — Frappe ERPNext

No mesmo produto, das mais perigosas para as menos.

CVE-2026-94113HIGHFrappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet EndpointsEPSS 0.4%CVE-2026-96672MEDIUMFrappe ERPNext before 16.34.1 Unauthorized Method InvocationEPSS 0.4%CVE-2026-12895HIGHSQL Injection in Frappe's ERPNextEPSS 0.4%CVE-2026-13227HIGHERPNext v16.25.0 - Improper authorization in Prospect opportunities APIEPSS 0.3%CVE-2026-42839MEDIUMERPNext 16.16.0 - Stored XSS in POS cart item renderingEPSS 0.3%CVE-2026-109377MEDIUMERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup MethodsEPSS 0.3%