Frappe ERPNext versions prior to 16.34.1 do not validate the calculation_formula field of Financial Report Template documents, allowing managers to supply arbitrary dotted Python paths to frappe.call(). When executed, these paths invoke internal server‑side methods that are not on the authorized list and expose their return values. This flaw can enable the attacker to run arbitrary code or retrieve sensitive data from the server, posing a significant confidentiality and integrity risk.

The vulnerability affects all installations of Frappe ERPNext using a Financial Report Template that references a calculation_formula, specifically versions before 16.34.1 of the ERPNext application. Users with the Accounts Manager role have the necessary access to create or modify such templates, providing the necessary entry points for exploitation.

The CVSS score of 5.3 suggests a moderate severity for this flaw. Exploitation requires authenticated access with Accounts Manager privileges and the ability to modify a financial report template, so it is not a pure remote attack vector. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the potential to execute arbitrary server‑side code warrants timely attention. The attacker would likely target users with sufficient permissions, especially in environments where financial reporting is a critical function.