CVE-2026-96672: Frappe ERPNext RCE Vulnerability

CVE-2026-96672 Overview

CVE-2026-96672 affects Frappe ERPNext versions before 16.34.1. The Financial Report Template feature fails to validate that calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values. This is a Use of Externally-Controlled Input to Select Classes or Code weakness [CWE-470]. The issue enables authenticated users with the Accounts Manager role to read data returned by internal methods that were never intended to be exposed through the client API surface.

Critical Impact

Authenticated Accounts Managers can invoke arbitrary non-whitelisted server-side methods and retrieve their return values, leading to unauthorized information disclosure.

Affected Products

• Frappe ERPNext versions before 16.34.1
• ERPNext Financial Report Template component
• Accounts module financial_report_engine.py

Discovery Timeline

• 2026-09-23 - CVE-2026-96672 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96672

Vulnerability Analysis

The Financial Report Template DocType allows users to configure calculated rows through a calculation_formula field. When a report renders, the server-side engine in financial_report_engine.py passes the user-supplied dotted path to frappe.call() without confirming the target method is decorated as whitelisted via @frappe.whitelist(). Frappe's whitelist decorator is the framework's primary boundary that determines which functions are callable from an authenticated session. Bypassing that boundary allows an Accounts Manager to reach any importable Python callable in the ERPNext or Frappe codebase and observe its return value.

Root Cause

The root cause is missing input validation on the calculation_formula field [CWE-470]. The engine treated the field as a trusted method reference. The upstream fix introduces a get_valid_api_method helper that verifies the resolved callable is whitelisted before dispatch. Vulnerable code path: erpnext/accounts/doctype/financial_report_template/financial_report_engine.py lines 1166-1171.

Attack Vector

Exploitation requires network access to the ERPNext web interface and an authenticated session with the Accounts Manager role. The attacker creates or edits a Financial Report Template, sets calculation_formula to an arbitrary dotted Python path such as frappe.get_all or an internal helper, and triggers report execution. The server invokes the method and returns its output to the client.

# Security patch excerpt - financial_report_engine.py
#
#  AccountFilterValidator,
#  CalculationFormulaValidator,
#  DependencyValidator,
+  get_valid_api_method,
# )
# from erpnext.accounts.report.financial_statements import (
#  get_columns,

Source: ERPNext Commit 7aad59b

The patch imports get_valid_api_method and applies it to validate that any dotted path supplied through the Financial Report Template resolves to a whitelisted API method before being passed to frappe.call().

// Client UI update - financial_report_template.js
-  <p>Path to your custom method that returns financial data.</p>
+  <p>Path to your custom whitelisted method that returns financial data. It must permit GET requests.</p>

Source: ERPNext Commit 7aad59b

The UI change communicates the new server-side requirement that custom methods must be whitelisted and GET-capable.

Detection Methods for CVE-2026-96672

Indicators of Compromise

• Financial Report Template records with calculation_formula values pointing to internal or undocumented dotted paths outside the documented API surface.
• Application logs showing frappe.call() dispatches to non-whitelisted methods originating from the Financial Report engine.
• Unexpected read access patterns by user accounts holding the Accounts Manager role.

Detection Strategies

• Audit the tabFinancial Report Template table for calculation_formula values that do not match approved report helper methods.
• Enable Frappe request logging and search for API invocations to server methods that lack the @frappe.whitelist() decorator.
• Correlate Accounts Manager session activity against report execution events to identify probing behavior.

Monitoring Recommendations

• Alert on modifications to Financial Report Template documents, especially changes to the calculation_formula field.
• Monitor role assignments for the Accounts Manager role and track new grants.
• Ingest ERPNext application and web server logs into a centralized analytics platform for retroactive hunting.

How to Mitigate CVE-2026-96672

Immediate Actions Required

• Upgrade Frappe ERPNext to version 16.34.1 or later, which contains commit 7aad59b.
• Review all existing Financial Report Template records and remove any calculation_formula values that reference non-whitelisted methods.
• Restrict the Accounts Manager role to a minimal set of trusted users pending patch deployment.

Patch Information

The fix is delivered in ERPNext commit 7aad59b129711e9bba17b25665428d1fc57bf37c and released in version 16.34.1. It introduces get_valid_api_method to validate that any dotted path resolves to a @frappe.whitelist() decorated callable before dispatch through frappe.call(). Details are documented in GitHub Security Advisory GHSA-794x-fhm7-58j7 and the VulnCheck Advisory for ERPNext.

Workarounds

• Temporarily revoke the Accounts Manager role from users who do not require Financial Report Template editing.
• Apply DocType-level permission changes to prevent write access to Financial Report Template until upgrade.
• Add a pre-save server script that rejects calculation_formula values not matching an approved allowlist.

# Upgrade ERPNext to the patched release
bench update --patch
bench get-app --branch version-16 erpnext
bench --site <sitename> migrate
bench version | grep erpnext  # confirm >= 16.34.1