CVE-2026-103544CWE-488

CVE-2026-103544

Medium · published October 1, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00228 · 12.9th percentile
Weakness
CWE-488 · Exposure of Data Element to Wrong Session
Published
2026-10-01T11:16Z
References (7)
https://github.com/datadrivenconstruction/OpenConstructionERP/ · [email protected]https://github.com/datadrivenconstruction/OpenConstructionERP/releases/tag/v15.0.0 · [email protected]https://github.com/datadrivenconstruction/OpenConstructionERP/security/advisories/GHSA-wfpw-cv5v-64j5 · [email protected]https://vuldb.com/cve/CVE-2026-103544 · [email protected]https://vuldb.com/submit/957984 · [email protected]https://vuldb.com/vuln/412354 · [email protected]https://vuldb.com/vuln/412354/cti · [email protected]
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 06:15Z
    datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session
    cvelistv5