CVE-2026-96672

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 16.34.1

Description Accounts Managers can invoke non-whitelisted internal server-side methods and read their return values. This occurs because the software fails to validate that the calculation formula values within the Financial Report Template reference whitelisted methods before they are passed to the frappe.call() function. An attacker can supply arbitrary dotted Python paths to execute these unauthorized methods.

Recommendations Update to version 16.34.1 or later.