CVE-2026-96672

Published: Sep 23, 2026Modified: Sep 29, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.

Related CWEs

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

References (6)

https://github.com/frappe/erpnext

Source: disclosure@vulncheck.com

https://github.com/frappe/erpnext/blob/v16.34.0/erpnext/accounts/doctype/financial_report_template/financial_report_engine.py#L1166-L1171

Source: disclosure@vulncheck.com

https://github.com/frappe/erpnext/blob/v16.34.0/erpnext/accounts/doctype/financial_report_template/financial_report_template.json

Source: disclosure@vulncheck.com

https://github.com/frappe/erpnext/commit/7aad59b129711e9bba17b25665428d1fc57bf37c

Source: disclosure@vulncheck.com

https://github.com/frappe/erpnext/security/advisories/GHSA-794x-fhm7-58j7

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/frappe-erpnext-before-16.34.1-unauthorized-method-invocation

Source: disclosure@vulncheck.com

Timeline

No history available yet.