MEDIUM 6.3 NVD
CVE-2026-110218
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the custo
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.
References
- https://github.com/aureuserp/aureuserp
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/blogs/src/Filament/Custo
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/blogs/src/Filament/Custo
- https://github.com/aureuserp/aureuserp/releases/tag/v1.6.0
- https://hackmd.io/@leediay/ryPaE-t9fl
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-13 via NVD.
vulnfeed aggregates 14602 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.