CVE-2026-111632: medium-severity vulnerability in aureuserp
Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
aureuserp · aureuserpRelated CVEs — aureuserp
In the same product, most dangerous first.
References
https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/partners/src/Http/Requests/PartnerRequest.php#L52https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/support/src/Traits/BelongsToCompany.php#L10-L19https://github.com/aureuserp/aureuserp/commit/5dab06a958d1e7546cf9f2ebf48f9843909ed972https://hackmd.io/@leediay/HygpHMknGlhttps://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-multi-company-authorization-bypass-via-company-id