CVE-2026-96672 — Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.cal…
Published: 2026-09-23 · CVSS: 5.3 · CVSS 4.0
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7