CVE-2026-96672: Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 16.34.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Accounts Manager role can exploit it by supplying a crafted calculation_formula in a Financial Report Template.
What access does an attacker need?
The attacker needs network access and low-level authenticated privileges; no user interaction is required. The affected functionality allows the attacker to invoke arbitrary dotted Python paths for non-whitelisted internal server-side methods and read their return values.
Which versions are affected and what is the fix?
ERPNext versions before 16.34.1 are affected. Upgrade to version 16.34.1 or later.