CVE-2026-92752

HighCVSS 8.3

Published: 16/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.

Risk Assessment

An attacker can access confidential attachments and comments and modify or delete them, compromising the confidentiality and integrity of business data.

Recommendation

Upgrade metasfresh to a patched version and ensure the attachments and comments endpoints enforce record-level permissions.

Other vulnerabilities in metasfresh

CVE-2026-111351Medium
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS