CVE-2026-96672: Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-09-29
Weakness: CWE-470

Description

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.

Affected products

frappe erpnext: from 16.0.0 before 16.34.1 — fixed in 16.34.1

How to fix

Upgrade to a fixed version: frappe erpnext 16.34.1. Check the vendor advisory for mitigations.

References

https://github.com/frappe/erpnext
https://github.com/frappe/erpnext/blob/v16.34.0/erpnext/accounts/doctype/financial_report_template/financial_report_engine.py#L1166-L1171
https://github.com/frappe/erpnext/blob/v16.34.0/erpnext/accounts/doctype/financial_report_template/financial_report_template.json
https://github.com/frappe/erpnext/commit/7aad59b129711e9bba17b25665428d1fc57bf37c
https://github.com/frappe/erpnext/security/advisories/GHSA-794x-fhm7-58j7
https://www.vulncheck.com/advisories/frappe-erpnext-before-16.34.1-unauthorized-method-invocation

Get alerted when CVE-2026-96672 or the next vulnerability affects your stack