CVE-2026-96672: Frappe Erpnext

Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.

Affected products

• Frappe Erpnext: from 16.0.0, before 16.34.1 (fixed in 16.34.1)

Published 2026-09-23. Last modified 2026-09-29.