Information Disclosure Vulnerability in Frappe ERPNext Product

CVE-2026-94113

What is CVE-2026-94113?

The Frappe ERPNext platform is affected by an information disclosure vulnerability present in its timesheet endpoints. This flaw permits authenticated attackers to invoke specific endpoints (get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet) without adequate authorization, leading to unauthorized access to sensitive data. Attackers can potentially enumerate and extract billable time logs along with associated project names, billing amounts, and work descriptions, which could lead to further exploitation.

References