ERPNext CVE-2026-94113

Requires a valid authenticated ERPNext session with any low-privilege role (PR:L) - the whitelisted endpoints get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet are callable by authenticated users and, before 15.121.0 / 16.34.0, ran raw SQL that ignored Timesheet/Project doctype permissions. No user interaction, no special configuration, and no admin rights are needed; exploitation works against default configurations. Limiting factors: attacker must have an account on the instance (not remote-unauthenticated), only billable/submitted timesheet detail data is exposed, and impact is limited to reading data (no modification). Affected: ERPNext before 15.121.0 and 16.x before 16.34.0.

This is a genuine but bounded authorization flaw (CWE-862). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) is internally consistent with the description: any authenticated ERPNext user can call the whitelisted timesheet endpoints and read billable time logs belonging to other users/projects because the pre-patch code ran raw frappe.db.sql with no doctype-permission filtering. The source diff confirms the root cause and fix - raw SQL was replaced with frappe.get_list(...)/frappe.qb scoped to allowed_timesheets/allowed_projects, which is exactly the permission enforcement that was missing. Impact is confidentiality-only (VI:N/VA:N is correct - no write or availability effect), so this is not a takeover or RCE. There is no EPSS, KEV, or public POC provided, so exploitation is neither confirmed active nor demonstrated. The realistic priority is moderate: it requires a valid low-privileged account and only leaks business-sensitive data (project names, billing amounts, descriptions), not credentials or system control. Treat as an authorization/data-leak bug to patch on a normal cadence, not an emergency. Note the 'Authentication Bypass' tag is misleading - this is missing authorization for already-authenticated users, not an auth bypass.

A low-privileged authenticated ERPNext user (e.g., a limited employee or portal account) invokes the whitelisted RPC endpoints get_projectwise_timesheet_data, get_timesheet_detail_rate, or get_timesheet, which failed to apply doctype permissions. By iterating parameters they enumerate and retrieve other teams' billable time logs - project names, billing amounts, and work descriptions - that their role should not see. No public POC is provided, but the exploit is trivial given a valid session and knowledge of the endpoint names, which are visible in the patched source.