CVE-2026-111351 in metasfresh
Summary
by MITRE • 10/16/2026
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The identified vulnerability represents a critical failure in server-side authorization controls within the metasfresh application, specifically affecting versions up through 5.175. This flaw is classified as a Broken Access Control issue, aligning with CWE-284 which describes improper control of interaction between users and system components. The core technical deficiency lies within the BoardRestController module, where the implementation fails to enforce record-level security policies consistently across all exposed endpoints. While higher-level application logic may correctly restrict user access based on organizational boundaries or role-based permissions, the specific REST API handlers for board operations do not adequately validate that the authenticated user possesses sufficient privileges to interact with the targeted resources. This discrepancy creates a significant gap in the defense-in-depth strategy, allowing attackers who have already obtained valid authentication credentials but lack elevated privileges to circumvent intended security restrictions.
The operational impact of this vulnerability is severe due to its potential for both unauthorized data disclosure and malicious modification of business-critical information. Attackers can exploit specific endpoints such as getBoard and getCard to retrieve sensitive board configurations and card details that are strictly scoped to other organizations or user groups within the system. This capability effectively neutralizes multi-tenancy features if present, leading to a complete breach of data isolation expectations. Furthermore, the ability to invoke addCard, removeCard, and patchCard handlers enables adversaries to alter board states arbitrarily. They can inject fraudulent tasks, delete existing work items, or reassign responsibilities without authorization. This not only compromises the confidentiality and integrity of business processes but also undermines operational reliability by introducing unverified changes into active workflows that other legitimate users depend upon for daily operations.
From a threat modeling perspective, this vulnerability facilitates privilege escalation through access control bypass techniques rather than traditional code execution exploits. It maps directly to MITRE ATT&CK technique T1078, specifically the Valid Accounts sub-technique where attackers leverage existing credentials but exploit misconfigured permissions to achieve unauthorized actions. The attack vector is remote and requires only valid authentication, making it highly exploitable against any user with a low-level account in the system. There are no complex preconditions required beyond network connectivity to the application server, which significantly lowers the barrier for entry compared to vulnerabilities requiring specific input manipulation or buffer overflow conditions.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to apply the vendor-provided security patch that updates metasfresh to a version newer than 5.175, where these authorization checks have been corrected in the BoardRestController implementation. In environments where immediate patching is not feasible due to operational constraints, temporary compensating controls should be implemented at the network or application gateway level. This includes restricting direct access to REST API endpoints associated with board management for low-privilege user groups and enforcing strict input validation on all requests targeting these handlers. Additionally, organizations should conduct a comprehensive audit of their role-based access control policies to ensure that future development cycles include automated testing for authorization logic in all new or modified controller methods. Regular security assessments focusing on broken object level authorization patterns are essential to prevent similar gaps from emerging as the application evolves.