CVE-2026-95655 in Aureus ERP
Summary
by MITRE • 09/22/2026
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Aureus ERP versions prior to 1.5.0 represents a critical failure in access control mechanisms within the ChatterPanel module. This component is designed to facilitate internal communication and collaboration by displaying messages associated with specific records or entities. However, the underlying implementation fails to properly scope message lookups to the context of the currently authenticated user's record. Instead of validating that the requested message belongs to a resource accessible by the current session, the application relies on predictable sequential identifiers for message retrieval without enforcing strict ownership checks. This architectural flaw allows any authenticated user to bypass intended isolation boundaries between different departments or distinct companies operating within the same multi-tenant instance.
From a technical perspective, this is classified as an Insecure Direct Object Reference (IDOR), corresponding to CWE-639 in the Common Weakness Enumeration standard. The application accepts message identifiers provided by the client and directly uses them to query the database without verifying if the requesting user has permission to view that specific object. Because these identifiers are sequential, attackers can easily enumerate valid IDs through brute-force techniques or simple iteration scripts. By submitting a range of incremental message IDs, an attacker can systematically retrieve messages intended for other users, effectively breaking the logical isolation required in multi-tenant environments. This lack of authorization checks extends beyond read access to include write and delete operations if those functionalities are exposed via similar endpoints without proper validation.
The operational impact of this vulnerability is severe due to the sensitive nature of enterprise resource planning communications. Authenticated attackers can not only view private messages but also edit, delete, or pin them for other users. This capability enables malicious insiders or compromised accounts to disrupt business operations by altering critical information, deleting evidence of misconduct, or manipulating pinned content to mislead colleagues and management. Furthermore, the ability to enumerate all notes in the system provides a comprehensive view of internal communications that may contain confidential strategic plans, financial data, personal employee information, or proprietary intellectual property. This exposure violates fundamental principles of confidentiality and integrity within the CIA triad, potentially leading to significant reputational damage, regulatory non-compliance, and competitive disadvantage for affected organizations.
This vulnerability aligns with several tactics in the MITRE ATT&CK framework, specifically relating to Collection techniques such as Data from Information Repositories (T1213) and potential Lateral Movement if used to gather intelligence for further attacks. The ability to modify or delete messages also touches upon Impact categories like Data Manipulation. To mitigate this risk, organizations running Aureus ERP versions earlier than 1.5.0 must upgrade immediately to the patched version where these access control checks have been implemented. For environments that cannot be upgraded instantly, network-level controls such as Web Application Firewalls can be configured to detect and block sequential ID enumeration patterns, although this is a less reliable defense compared to fixing the root cause in the application code. Developers should also conduct a thorough review of other endpoints within the ChatterPanel module to ensure no similar authorization flaws exist where object references are not properly validated against user permissions before processing requests.