CVE-2026-96672

Frappe ERPNext versions before 16.34.1 are vulnerable to an unauthorized method invocation due to insufficient validation of calculation_formula values within Financial Report Templates. The application fails to verify that these values reference whitelisted methods before passing them to frappe....

CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

PT-2026-97358

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 16.34.1 Description Accounts Managers can invoke non-whitelisted internal server-side methods and read their return values. This occurs because the software fails to validate that the calculation formula values...

CVE-2026-96672: Use of Externally-Controlled Input to Select Classes or Code

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...