SB20261109176 - Unsafe reflection in ERPNext

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109176

SB20261109176 - Unsafe reflection in ERPNext

Published: November 9, 2026 Updated: November 10, 2026

Security Bulletin ID SB20261109176
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Unsafe reflection (CVE-ID: CVE-2026-96672)

CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker with permission to author reporting configurations to invoke internal ERPNext methods and read their return values.

The vulnerability exists due to missing validation in ERPNext reporting configuration processing, which invokes caller-supplied server-side method references without restricting them to an approved set. A low-privileged remote attacker with permission to author reporting configurations can supply an unapproved method reference to execute internal application code and retrieve its output.


Remediation

Install update from vendor's website.

References