CVE-2026-27471
CriticalSummary
ERP to darmowe i otwarte narzędzie do zarządzania zasobami przedsiębiorstwa. W wersjach do 15.98.0 oraz 16.0.0-rc.1 i przez 16.6.0 niektóre punkty końcowe nie miały walidacji dostępu, co umożliwiało nieautoryzowany dostęp do dokumentów. Problem został naprawiony w wersjach 15.98.1 i 16.6.1.
Risk Assessment
Brak walidacji dostępu do dokumentów może prowadzić do ujawnienia poufnych informacji, co stwarza ryzyko dla bezpieczeństwa organizacji. Nieautoryzowany dostęp do danych może skutkować naruszeniem prywatności oraz regulacji prawnych.
Recommendation
Zaleca się aktualizację do wersji 15.98.1 lub 16.6.1, aby zabezpieczyć system przed nieautoryzowanym dostępem do dokumentów. Należy również przeprowadzić audyt istniejących punktów końcowych w celu zapewnienia odpowiedniej walidacji dostępu.
Related vulnerabilities
- CVE-2026-81797Critical
The WordPress theme Buzz Stone | Magazine & Viral Blog in versions up to 1.0.2 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78535Critical
The WordPress theme Photolia in versions up to 1.0.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78533Critical
The WordPress theme Qwery in versions up to 3.6.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78531Critical
The WordPress theme Jacqueline in versions up to 2.22 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78529Critical
The WordPress theme Alliance in versions up to 3.11 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66569Critical
The WordPress theme Kicker in versions up to 2.2.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66568Critical
The WordPress theme Original in versions up to 1.9.0 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66567Critical
The WordPress theme Anesta in versions up to 1.5.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66565Critical
The WordPress theme FC United in versions up to 1.1.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66564Critical
The WordPress theme ShiftCV in versions up to 3.0.14 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
Original NVD description (English source)
ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS