CVE-2026-95655CWE-639

CVE-2026-95655

High · published September 22, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00488 · 41.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-22T20:18Z
References (8)
https://github.com/aureuserp/aureuserp · [email protected]https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L503 · [email protected]https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L685 · [email protected]https://github.com/aureuserp/aureuserp/commit/d3d5ac20ec544e97636490db6f86a391c04ce899 · [email protected]https://github.com/aureuserp/aureuserp/pull/1382 · [email protected]https://github.com/aureuserp/aureuserp/releases/tag/v1.5.0 · [email protected]https://hackmd.io/@leediay/idor-chatter-messager-aureus · [email protected]https://www.vulncheck.com/advisories/aureus-erp-before-1.5.0-unscoped-message-access-via-chatterpanel · [email protected]
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 22 SEP 15:24Z
    Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
    cvelistv5