Frappe ERPNext Timesheet Endpoints Allow Unauthorized Data Disclosure

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

• Frappe ERPNext: versions < 15.121.0 are affected; 15.121.0 is the patched release for this branch.
• Frappe ERPNext: 16.x versions < 16.34.0 are affected; 16.34.0 is the patched release for this branch.
• The record and reviewed advisories do not establish affected or fixed boundaries for branches outside those listed above.

The flaw affects whitelisted timesheet functions that do not fully enforce permissions on the Timesheet, Timesheet Detail, and Project doctypes. The affected endpoints are get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet; an authenticated request can reach them and receive records outside the caller's authorized scope. get_projectwise_timesheet_data queries billable time records that can include project names, hours, billing amounts, currency, and work descriptions, while the other functions support timesheet lookup or billing-rate retrieval. The fixes constrain queries to Timesheet and Project records returned by permission-aware list operations and bind Timesheet Detail results to permitted parent timesheets. The available evidence does not establish how every deployment configuration or custom permission scheme changes reachability.

The vulnerable functions are reachable through network requests to ERPNext and require an authenticated account with low privileges. The supplied assessment indicates that no user interaction is required and that the request path has low complexity. The endpoints can be used to enumerate or retrieve timesheet data that the account is not authorized to read. Available evidence does not establish confirmed exploitation or a public exploit, so exploitation status remains unknown.

• The primary technical outcome is loss of confidentiality for data returned by the affected timesheet functions, not data modification or service outage.
• An attacker needs an authenticated ERPNext account, but does not need interaction from another user.
• Potentially exposed data includes project names, billing amounts, currency information, work times, and work descriptions.
• Organizational consequences may include disclosure of commercially sensitive or customer-related project information. The practical severity depends on the timesheet data stored by the deployment and the permissions held by the abused account.

The flaw can expose confidential project timekeeping and billing records to an authenticated user who is not authorized to view them. Disclosed information may include project names, billable values, work hours, and descriptions, which could affect commercial confidentiality, privacy, or customer-management processes. The documented consequence is loss of confidentiality; there is no evidence that the flaw itself permits data modification or service disruption. Because authentication is required, practical exposure depends on the ERPNext accounts already present and their ability to reach the application.

1. Upgrade the ERPNext 15 branch to exactly 15.121.0.
2. Upgrade the ERPNext 16 branch to exactly 16.34.0.
3. The vendor advisory documents no workaround; upgrading is required to remediate the flaw.
4. After upgrading, recheck the timesheet module and confirm that queries return only Timesheet, Timesheet Detail, and Project records readable by the current account.
5. Review pre-upgrade access logs to assess whether the affected functions were called by accounts that should not have been able to access the returned records.

• Inventory deployed ERPNext systems, identify each exact release, and compare it with the affected branches in affected_summary.
• Inspect erpnext/projects/doctype/timesheet/timesheet.py and verify that get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet restrict results to records readable by the requesting user.
• As a precaution, review application or API logs for requests to the three affected functions, especially calls made by low-privilege accounts.
• In an approved test environment, use a deliberately limited account to confirm that responses contain only timesheets and projects within that account's authorized scope.
• Do not treat the absence of matching log entries as proof that the system is unaffected or that no data was accessed.