CVEvulnerability
CVE-2026-95655
8.6 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-09-22
- Last modified
- 2026-09-28
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-639
Description
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://github.com/aureuserp/aureuserp github.com
- https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L503 github.com
- https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L685 github.com
- https://github.com/aureuserp/aureuserp/commit/d3d5ac20ec544e97636490db6f86a391c04ce899 github.com
- https://github.com/aureuserp/aureuserp/pull/1382 github.com
- https://github.com/aureuserp/aureuserp/releases/tag/v1.5.0 github.com
- https://hackmd.io/@leediay/idor-chatter-messager-aureus hackmd.io
- https://www.vulncheck.com/advisories/aureus-erp-before-1.5.0-unscoped-message-access-via-chatterpanel www.vulncheck.com