CVE-2026-103544 in OpenConstructionERP
Summary
by MITRE • 10/01/2026
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in datadrivenconstruction OpenConstructionERP versions up through 14.8.1 represents a critical security flaw within the application's artificial intelligence provider configuration handler module. Specifically, the defect resides in an unknown function located at backend/app/modules/ai/ai_client.py. This component is responsible for managing interactions with external AI services and handling associated configuration data. The core technical issue involves improper session management logic that fails to correctly isolate or bind specific data elements to their intended user sessions. Instead of ensuring strict separation between concurrent user activities, the flawed implementation allows sensitive information related to one user's context to be exposed to another user's active session. This type of error is fundamentally a failure in access control and state validation during runtime operations involving external service integrations.
From a technical perspective, this flaw aligns with CWE-200, which categorizes vulnerabilities where an attacker can gain information about resources from the application that they are not supposed to be able to see. More specifically, it reflects characteristics of CWE-613, Insufficient Session Expiration, or potentially CWE-384, Session Fixation if session identifiers are improperly handled alongside data exposure. The root cause likely stems from a lack of proper scoping for variables storing AI provider credentials or configuration states within the application's memory space during asynchronous processing requests. When multiple users interact with the AI features simultaneously, the server may incorrectly reuse or misassign cached responses or configuration objects belonging to one session when serving another. This breaks the fundamental assumption that web sessions are isolated containers of user-specific state and data.
The operational impact of this vulnerability is severe due to its remote exploitability and the nature of the exposed data. Since the attack can be initiated remotely, an unauthenticated attacker does not need physical access or prior authentication to potentially trigger conditions leading to information leakage, although exploitation typically requires some level of interaction with the AI configuration endpoints. The exposure of data elements to the wrong session means that sensitive operational details, API keys for third-party AI services, or proprietary construction project configurations could be leaked to unauthorized users within the same instance. In an enterprise environment like OpenConstructionERP, such leakage can lead to significant business intelligence theft, compromise of integrated service accounts, and potential downstream attacks leveraging stolen credentials. The fact that a public exploit exists further amplifies the risk, as automated scanning tools or malicious actors can readily leverage this flaw without needing custom development efforts.
This vulnerability also maps to specific tactics in the MITRE ATT&CK framework, particularly those related to Credential Access and Discovery. An attacker could use session hijacking techniques (T1539) to steal active sessions if cookies are compromised via side-channel data leakage, or employ unauthorized access to sensitive information (T1005). The ability to manipulate requests to cause cross-session data exposure is a precursor to more sophisticated attacks such as privilege escalation or lateral movement within the organization's network infrastructure. Given that OpenConstructionERP handles critical project management and financial data for construction firms, the integrity of these sessions is paramount for maintaining business continuity and regulatory compliance regarding data privacy standards like GDPR or CCPA.
To mitigate this risk immediately, organizations running affected versions must prioritize upgrading to version 15.0.0 or later as recommended by the vendor. This update presumably contains patches that enforce strict session isolation, validate request origins against active user contexts, and sanitize variable scoping within the ai_client.py module. Until an upgrade is feasible, administrators should consider implementing network-level controls such as Web Application Firewalls (WAF) to detect anomalous patterns in AI endpoint requests that might indicate exploitation attempts. Additionally, enabling comprehensive logging for session creation and data access events can aid in monitoring for signs of unauthorized cross-session activity. Regular security audits focusing on state management logic in third-party integrations are also advised to prevent similar flaws from persisting in other modules of the application ecosystem.