CVE-2026-111632: falha de média gravidade em aureuserp
Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
probabilidade de exploração
0.3%top 79% das CVEs
exploração observada
nãonenhuma fonte reporta
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
aureuserp · aureuserpCVEs relacionadas — aureuserp
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/partners/src/Http/Requests/PartnerRequest.php#L52https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/support/src/Traits/BelongsToCompany.php#L10-L19https://github.com/aureuserp/aureuserp/commit/5dab06a958d1e7546cf9f2ebf48f9843909ed972https://hackmd.io/@leediay/HygpHMknGlhttps://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-multi-company-authorization-bypass-via-company-id