CVE-2026-103544

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103544
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103544.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103544
Aliases
  • GHSA-wfpw-cv5v-64j5
Published
2026-10-01T06:15:12Z
Modified
2026-10-03T03:46:35Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session
Details

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-488"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103544.json"
}
References

Affected packages

Git / github.com/datadrivenconstruction/openconstructionerp

Affected ranges

Type
GIT
Repo
https://github.com/datadrivenconstruction/openconstructionerp
Events
Introduced
02a27cd8d6c1529d3e1cf08f824b8562f4e3ac09
Fixed
ed97fc22d96c9424a35d8689b73b95aad6aebe9c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "14.8.0"
        },
        {
            "last_affected":  "14.8.0"
        },
        {
            "introduced":  "14.8.1"
        },
        {
            "last_affected":  "14.8.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

14.*
14.8.0
14.8.1
v14.*
v14.8.0
v14.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103544.json"