CVE-2026-111632

Published: Oct 16, 2026Modified: Oct 16, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (6)

https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/partners/src/Http/Requests/PartnerRequest.php#L52

Source: disclosure@vulncheck.com

https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/support/src/Traits/BelongsToCompany.php#L10-L19

Source: disclosure@vulncheck.com

https://github.com/aureuserp/aureuserp/commit/5dab06a958d1e7546cf9f2ebf48f9843909ed972

Source: disclosure@vulncheck.com

https://hackmd.io/@leediay/HygpHMknGl

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-multi-company-authorization-bypass-via-company-id

Source: disclosure@vulncheck.com

https://hackmd.io/@leediay/HygpHMknGl

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.