CVE-2026-57869
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The vulnerability in MicroRealEstate stems from broken object-level access controls and the use of a deterministic pattern during random ID generation. This allows attackers to access documents uploaded by landlords or tenants without authorization.
Risk Assessment
The organization is at risk of leaking confidential documents, such as lease agreements or personal data, which could lead to privacy breaches and legal consequences.
Recommendation
Immediately update MicroRealEstate to a version newer than 1.0.0-alpha3 if available, or implement temporary mitigations such as strengthening access controls and using a cryptographically secure random number generator.
Other vulnerabilities in MicroRealEstate
See all- CVE-2026-57871High
Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate through version 1.0.0-alpha3.
- CVE-2026-57870Medium
A broken object-level access control vulnerability in the Template API of MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization.
- CVE-2026-57868High
MicroRealEstate is vulnerable to broken object-level access controls in its PDF generator functionality. This affects versions through 1.0.0-alpha3.
- CVE-2026-57867High
A vulnerability in MicroRealEstate allows attackers to bypass authentication due to a lack of token state management. This enables brute-forcing One-Time Passwords (OTP) to log in as any user.
Original NVD description (English source)
Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS