ERPNext CVE-2026-109376

The attacker must hold an authenticated ERPNext portal account (customer/project portal user) that has been granted read access to a target Project, on an affected version 15.55.0 through 16.50.0. Exploitation specifically abuses the get_timesheet_html method in erpnext/templates/pages/projects.py, which validated only Project read access while ignoring the hide_timesheets flag and the project-membership (portal_users) association. Limiting factors: a valid portal login is required (no anonymous access), and the disclosed data is restricted to timesheet metadata - names, status, time-log dates and last modifiers - not full timesheet content, with no write or availability impact. Deployments that do not expose the project/customer portal to untrusted users, or that have upgraded past 16.50.0, are not exploitable.

This is a medium-severity information-disclosure flaw (CVSS 4.0 base 5.3) whose real-world urgency is modest rather than critical. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms a network-reachable, low-complexity attack requiring an authenticated portal account (PR:L), with impact limited to confidentiality (VC:L) and no integrity or availability effect - consistent with the description, which describes leaking timesheet metadata, not code execution or data modification. No EPSS score, CISA KEV entry, or SSVC decision data was supplied, and no public exploit was referenced; the only exploitation-related artifact is the vendor fix commit, which is remediation, not weaponized exploit code. These signals are internally consistent and all point to a bounded, authorization-only issue: a legitimate but under-privileged portal user can read timesheet details they should not see. Because exploitation requires a valid portal login and yields only limited confidentiality of project timesheet metadata, this is a patch-on-schedule item rather than an emergency, though organizations exposing the customer/project portal to many external users should rank it higher. EPSS, KEV, POC and SSVC inputs are all absent - treat that absence as missing data, not as evidence of low exploitability.

A customer or project portal user who has been granted read access to a Project - but is not a member permitted to see its timesheets, or for whom hide_timesheets is set - calls the get_timesheet_html endpoint for that project. Because the method only validates Project read access and ignores membership and the hide_timesheets flag, the server returns timesheet names, statuses, time-log dates and last-modifier identities. No public exploit was identified at time of analysis; exploitation is low-complexity (AC:L) but requires an authenticated portal session (PR:L).