Mmastodon TechnologyCybersecurity first seen 5 d ago, last 5 d ago, peak #9

Frappe ERPNext vulnerability exposes billable timesheet data

Original: CVE-2026-94113: Frappe ERPNext leaks billable timesheet data (project names, billing amounts, work logs) to any authenti

A newly disclosed vulnerability, CVE-2026-94113, affects Frappe ERPNext, a widely used open-source ERP platform. Any authenticated user can access billable timesheet data, including project names, billing amounts and work logs, through unpermitted endpoints. The flaw carries a CVSS score of 6.5. Fixes are available in versions 15.121.0 and 16.34.0, with users urged to upgrade immediately while an additional patch is under review.

Why now: Security teams are discussing the newly disclosed ERPNext flaw and urging administrators to upgrade to the patched versions.

FrappeERPNextCVE-2026-94113

Open on mastodon →

Evidence

• CVE-2026-94113: Frappe ERPNext leaks billable timesheet data (project names, billing amounts, work logs) to any authenticated user via unpermitted endpoints. CVSS 6.5. Fix in 15.121.0 and 16.34.0, patch under review - upgrade now. # CVE # infosec # ERPNext https://www.… · hugovalters

API: https://socialmediatrends-api.osmike.com/v1/trends/4464363