MEDIUM 5.3 NVD
CVE-2026-111632
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.
References
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/partners/src/Http/Reques
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/support/src/Traits/Belon
- https://github.com/aureuserp/aureuserp/commit/5dab06a958d1e7546cf9f2ebf48f9843909ed972
- https://hackmd.io/@leediay/HygpHMknGl
- https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-multi-company-authorization-
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-16 via NVD.
vulnfeed aggregates 16467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.