CVE-2026-57868
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
MicroRealEstate is vulnerable to broken object-level access controls in its PDF generator functionality. This affects versions through 1.0.0-alpha3.
Risk Assessment
An attacker can access sensitive property data or other objects without proper authorization, leading to information disclosure.
Recommendation
Upgrade MicroRealEstate to the latest version beyond 1.0.0-alpha3 if available, or implement access control mechanisms at the application level.
Other vulnerabilities in MicroRealEstate
See all- CVE-2026-57871High
Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate through version 1.0.0-alpha3.
- CVE-2026-57870Medium
A broken object-level access control vulnerability in the Template API of MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization.
- CVE-2026-57869High
The vulnerability in MicroRealEstate stems from broken object-level access controls and the use of a deterministic pattern during random ID generation. This allows attackers to access documents uploaded by landlords or tenants without authorization.
- CVE-2026-57867High
A vulnerability in MicroRealEstate allows attackers to bypass authentication due to a lack of token state management. This enables brute-forcing One-Time Passwords (OTP) to log in as any user.
Original NVD description (English source)
MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: through 1.0.0-alpha3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS