CVE-2026-95655
HighCVSS 8.1Summary
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
Risk Assessment
An authenticated user can access confidential messages and notes from other departments or companies, breaching data confidentiality and integrity. This may lead to leakage of business information and sabotage.
Recommendation
Update Aureus ERP to version 1.5.0 or later. Until then, restrict user permissions and monitor for unusual message access requests.
Other vulnerabilities in Aureus ERP
See all- CVE-2026-94387Medium
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.
- CVE-2026-93454Medium
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.
Original NVD description (English source)
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.