Is CVE-2026-96672 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-96672?

CVE-2026-96672 has a CVSS v3 severity of MEDIUM (6.4).

Back

CVE-2026-96672

Description

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.