The vulnerability resides in whitelisted timesheet endpoints of Frappe ERPNext. The endpoints fail to enforce doctype permissions, allowing an authenticated user to call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet. This leads to enumeration and retrieval of billable time logs, including project names, billing amounts and work descriptions, without proper authorization checks. The result is a breach of confidentiality of sensitive business information.

The vulnerability affects all Frappe ERPNext deployments running versions prior to 15.121.0 and all 16.x releases prior to 16.34.0. These versions are available from the ERPNext product line.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score is not available, and the issue is not in the CISA KEV catalog, suggesting that while exploitation is possible, it may not be widely leveraged yet. Attackers must first authenticate to the system, and then they can use the exposed endpoints to access private timesheet data. Because the endpoints lack proper authorization, any authenticated user with access to the ERPNext interface can potentially disclose sensitive time-tracking and billing information.