CVE-2026-72600 in ERP CRM
Summary
by MITRE • 08/11/2026
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical broken access control flaw in Idurar IDURAR ERP CRM version 4.1.0 that exposes sensitive customer data through improper authentication mechanisms. The issue manifests through the /download router endpoint which lacks essential authentication middleware, creating an open pathway for unauthorized access to confidential information. This weakness aligns with CWE-285, which specifically addresses insufficient authorization in software systems where proper access controls fail to validate user credentials before granting system resources. The vulnerability enables unauthenticated remote attackers to directly access invoice PDF files containing personally identifiable information from customers, fundamentally compromising data protection protocols.
The technical implementation of this flaw stems from the absence of authentication checks within the download router component of the application's routing architecture. Attackers can exploit this by enumerating MongoDB ObjectIds through predictable patterns or brute force techniques, allowing them to systematically access any invoice stored in the database without requiring valid credentials. This enumeration capability demonstrates a lack of proper input validation and access control enforcement, creating an attack surface where all system resources become publicly accessible. The vulnerability is particularly dangerous because it operates at the application layer, bypassing network-level security controls and providing direct database access through the exposed API endpoint.
The operational impact of this vulnerability extends beyond simple data exposure to encompass significant regulatory compliance violations and potential financial losses. Customer PII contained within these invoice documents represents sensitive personal information that could be exploited for identity theft, fraud, or other malicious activities. Organizations using this ERP system face substantial risk of regulatory penalties under data protection frameworks such as gdpr, ccpa, and other privacy legislation that mandate proper access controls and data protection measures. The vulnerability also creates opportunities for attackers to conduct reconnaissance on the entire customer database, potentially identifying additional targets for further attacks or data breaches.
Mitigation strategies should focus on implementing robust authentication mechanisms across all application endpoints, particularly those handling sensitive data. The immediate fix involves adding authentication middleware to the /download router and ensuring proper access control validation before any data retrieval operations occur. Security controls should include input validation to prevent ObjectId enumeration attacks, rate limiting to prevent brute force attempts, and comprehensive logging of all access attempts to detect suspicious activities. Organizations should also implement proper role-based access controls that ensure users can only access data relevant to their authorized functions, aligning with the principle of least privilege as outlined in cybersecurity best practices. Additionally, regular security testing including penetration testing and vulnerability assessments should be conducted to identify similar access control weaknesses throughout the application architecture, addressing both current vulnerabilities and potential future exploits that may arise from similar implementation flaws.