---
id: CVE-2026-94113
title: >-
  Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an
  information disclosure vulnerability in whitelisted timesheet endpoints that
  fail to enforce doctype permissions
summary: >-
  Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an
  information disclosure vulnerability in whitelisted timesheet endpoints that
  fail to enforce doctype permissions. Authenticated attackers can call
  get_projectwise…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: Frappe
product: ERPNext
affected:
  - ERPNext < 15.121.0
  - ERPNext >= 16.0.0 < 16.34.0
published: '2026-09-20'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T17:19:19.843'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94113'
references:
  - url: >-
      https://github.com/frappe/erpnext/commit/c656497aac76af82eea028e3e8cb8d5380385f0f
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/frappe/erpnext/commit/d5df40986d72a55d414ddaf4d382883f9df31e41
    label: disclosure@vulncheck.com
  - url: 'https://github.com/frappe/erpnext/pull/58576'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/frappe/erpnext/security/advisories/GHSA-9vph-hqmm-g7hq'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-and-16.34.0-missing-authorization-in-timesheet-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T16:40:38.101380Z'
epss: 0.00422
epssPercentile: 0.33817
ingestedAt: '2026-09-20T12:21:05.903Z'
---

## Overview

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.