CVE-2026-95655

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/aureuserp/aureuserp
https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L503
https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L685
https://github.com/aureuserp/aureuserp/commit/d3d5ac20ec544e97636490db6f86a391c04ce899
https://github.com/aureuserp/aureuserp/pull/1382
https://github.com/aureuserp/aureuserp/releases/tag/v1.5.0
https://hackmd.io/@leediay/idor-chatter-messager-aureus
https://www.vulncheck.com/advisories/aureus-erp-before-1.5.0-unscoped-message-access-via-chatterpanel

Configurations

No configuration.

History

22 Sep 2026, 16:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-22 16:18

Updated : 2026-09-28 16:17

NVD link : CVE-2026-95655

Mitre link : CVE-2026-95655

CVE.ORG link : CVE-2026-95655

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-95655", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-95655", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-22T17:22:41.493052Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Webkul", "product": "Aureus ERP", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.5.0", "versionType": "semver"}], "packageURL": "pkg:composer/aureuserp/aureuserp", "defaultStatus": "unaffected"}]}], "published": "2026-09-22T16:18:18.943", "references": [{"url": "https://github.com/aureuserp/aureuserp", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L503", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L685", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/aureuserp/aureuserp/commit/d3d5ac20ec544e97636490db6f86a391c04ce899", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/aureuserp/aureuserp/pull/1382", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/aureuserp/aureuserp/releases/tag/v1.5.0", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@leediay/idor-chatter-messager-aureus", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/aureus-erp-before-1.5.0-unscoped-message-access-via-chatterpanel", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system."}], "lastModified": "2026-09-28T16:17:18.380", "sourceIdentifier": "disclosure@vulncheck.com"}