Is CVE-2026-109376 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109376?

CVE-2026-109376 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-109376

Description

ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.