Description

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-20T12:17:07.117Z",
  "pubdate": "2026-09-20T12:17:07.117Z",
  "executiveSummary": "Frappe ERPNext is susceptible to an Information Disclosure vulnerability stemming from improper access control enforcement within specific API endpoints. The vulnerability resides in whitelisted timesheet management functions, which fail to validate doctype permissions against the requesting user's authorization level.\nThe flaw allows authenticated attackers to bypass intended security constraints and exfiltrate sensitive operational data, including project-specific billable time logs, financial billing amounts, and detailed work descriptions.\nAffected systems include Frappe ERPNext versions prior to 15.121.0 and 16.x versions prior to 16.34.0. The risk is significant as it facilitates unauthorized access to proprietary business intelligence and internal work activity logs. Exploitation requires authenticated access to the application, but does not necessitate elevated privileges, effectively allowing any standard user to harvest data across the organization's project portfolio.",
  "technicalDetails": "The vulnerability is rooted in an authorization bypass within the Frappe framework's API layer. Specifically, the RPC endpoints 'get_projectwise_timesheet_data', 'get_timesheet_detail_rate', and 'get_timesheet' are configured as whitelisted methods, which historically implies direct accessibility. However, the underlying implementation fails to invoke the necessary document-level (doctype) permission checks typically enforced by the Frappe security layer when accessing sensitive record sets.\nThe attack flow initiates when an authenticated user sends an HTTP request to the aforementioned API endpoints. Because the backend logic lacks explicit verification of whether the requester possesses 'read' permissions for the queried records, the server processes the request and retrieves data from the database based solely on the provided arguments rather than the user's role-based access control (RBAC) profile.\nBy manipulating parameters within these requests, an attacker can enumerate and extract timesheet data across the entire installation, even for projects or departments they are not explicitly authorized to view. This effectively turns the API into an indiscriminate data retrieval mechanism for billable logs.\nThe sensitive information exposed through this vector includes project metadata, individual billing rates, granular work descriptions, and associated financial values. The breach of this information can lead to severe organizational impact, including the leakage of strategic project roadmaps, client billing structures, and intellectual property regarding internal workflows.\nAffected versions include any deployment of Frappe ERPNext version 15 below 15.121.0 and version 16 below 16.34.0. The vulnerability is strictly exploitable by users already present within the system, making it a critical threat from a malicious insider or compromised low-privileged account perspective. The vulnerability exists within the application's business logic layer, meaning it cannot be fully mitigated by network-level controls alone, as the traffic remains legitimate HTTP/HTTPS communication between the client and the ERPNext server."
}