ERPNext versions 15.55.0 through 16.50.0 contain an incorrect authorization flaw in the get_timesheet_html method. The vulnerability allows an authenticated portal user to view timesheet information from projects the user should not have access to. The method performs only a project read access check and ignores additional controls such as hide_timesheets and project membership. As a result, attackers can retrieve timesheet names, status, time‑log dates, and the last modifier of a timesheet. This flaw can lead to exposure of sensitive project data to unauthorised users, compromising confidentiality and potentially revealing organizational workload and resource allocation details.

The flaw affects ERPNext deployments from versions 15.55.0 up to and including 16.50.0. The affected product is managed by the Frappe company and is listed under the ERPNext family. The specific affected releases are those in the stated version range; newer releases beyond 16.50.0 are not impacted.

The CVSS score for this issue is 5.3, indicating a moderate severity. Exploitation requires only that the attacker be a portal user with unrestricted authentication to the system; no additional network access or elevated credentials are needed. Since the EPSS score is not available, the precise exploitation probability cannot be expressed, but the lack of a high CVSS suggests that while the vulnerability exists, widespread active exploitation is unlikely. The vulnerability is not listed as a known exploited vulnerability in CISA KEV catalog at this time.