Frappe ERPNext versions >=16.0.0 and <16.34.1 do not properly validate that calculation_formula values in Financial Report Templates only reference whitelisted methods before passing them to frappe.call(). This unsafe reflection vulnerability enables Accounts Managers to supply arbitrary dotted Python paths, invoking internal server-side methods that are not whitelisted, thereby potentially exposing sensitive data through their return values. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, and limited impact on confidentiality and integrity.

An attacker with Accounts Manager privileges can exploit this vulnerability to invoke arbitrary internal server-side methods and read their return values, potentially exposing sensitive information. The impact is limited by the requirement of authenticated privileges and the scope of accessible methods, resulting in a medium severity rating.

Upgrade Frappe ERPNext to version 16.34.1 or later, where this vulnerability is fixed by validating calculation_formula values against a whitelist before invoking methods. No other mitigations are indicated. Patch status is confirmed by the affectedVersions range indicating the fix in 16.34.1.