Frappe ERPNext EUVD-2026-85344

Requires an authenticated account holding the ERPNext Accounts Manager role with permission to create or edit Financial Report Template documents; the attacker must set a Custom API row's calculation_formula to an attacker-chosen dotted Python path. Exploitation is limited to ERPNext versions before 16.34.1 where financial_report_engine.py passes api_path straight to frappe.call() without validating it against whitelisted, GET-permitting methods. Limiting factors: the Accounts Manager role is a privileged, non-default identity that must be granted, no user interaction by a victim is needed, and after patching only whitelisted GET-enabled methods can be invoked. Impact is bounded to invoking internal methods and reading their return values rather than direct code execution.

This is a genuine but modest-severity issue best treated as medium-low priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3, and every signal points to a privilege-gated, limited-impact flaw rather than a wormable RCE: exploitation requires an authenticated user holding the Accounts Manager role (PR:L), and the technical impact is bounded - CWE-470 unsafe reflection lets the attacker resolve arbitrary dotted Python paths and invoke non-whitelisted internal methods, then READ their return values (VC:L/VI:L, no availability impact). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or automated exploitation - no public exploit identified at time of analysis. Note a tension worth verifying: the vendor rated confidentiality/integrity only Low and set subsequent-system metrics SC:L/SI:L, implying some cross-boundary effect, yet the described impact (reading internal method return values) is largely a same-system information-disclosure primitive; the real-world danger depends entirely on WHICH internal methods an attacker can reach and whether any have sensitive side effects, which is not enumerated. This is not a high-CVSS-but-illusory issue, but it is firmly a post-authentication, high-privilege-role problem, so real risk is concentrated in environments where the Accounts Manager role is broadly or loosely assigned.

An authenticated user with the ERPNext Accounts Manager role creates or edits a Financial Report Template and sets a row's calculation_formula (Custom API data source) to an arbitrary dotted path such as a sensitive internal server-side method instead of a whitelisted one. When the report runs, frappe.call() invokes that unvalidated method and returns its output to the attacker, enabling unauthorized invocation and data readback. No public exploit was identified at time of analysis; the low complexity (AC:L) means the attack is trivial once the required role is held.