Unsafe reflection in ERPNext - CVE-2026-96672
Published: November 9, 2026 / Updated: November 10, 2026
Vulnerability identifier: #VU163026
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96672
CWE-ID: CWE-470
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker with permission to author reporting configurations to invoke internal ERPNext methods and read their return values.
The vulnerability exists due to missing validation in ERPNext reporting configuration processing, which invokes caller-supplied server-side method references without restricting them to an approved set. A low-privileged remote attacker with permission to author reporting configurations can supply an unapproved method reference to execute internal application code and retrieve its output.
Affected software
ERPNext
How to mitigate CVE-2026-96672
Install security update from vendor's website.
ERPNext - update to 16.34.1