CVE-2026-94113: missing authorization in ERPNext timesheet

CVE-2026-94113 identifies missing authorization in Frappe ERPNext whitelisted timesheet endpoints. The endpoints get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet fail to enforce doctype permission checks. Authenticated attackers access billable time logs, project names, billing amounts, and work descriptions without proper authorization. The vulnerability affects ERPNext before 15.121.0 and all 16.x versions before 16.34.0.

With CVSS 6.5 rated as medium, this vulnerability represents a significant information disclosure risk for organizations using ERPNext for timesheet and billing management. The vulnerability was published by the National Vulnerability Database on 2026-09-20; as of 2026-11-07, public GitHub repositories containing technical proof-of-concept code have been confirmed, indicating that the security community has begun detailed analysis and attackers may follow suit.

IT administrators and CISOs must prioritize updating ERPNext to the correct releases: version 15.121.0 or later for the 15 series, or 16.34.0 or later for the 16 series. Before upgrading, verify the current version number in production and schedule a maintenance window. After patching, validate that authorization controls on timesheet endpoints are correctly enforced; also review access logs for the affected endpoints to identify any anomalous access or prior exploitation before the fix.