CVE-2026-110218

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110218
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110218.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110218
Published
2026-10-13T18:50:05Z
Modified
2026-10-15T02:47:23Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
Details

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110218.json"
}
References

Affected packages

Git / github.com/aureuserp/aureuserp

Affected ranges

Type
GIT
Repo
https://github.com/aureuserp/aureuserp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b33fa04643a936885f83b5ad39a62260ef27a7a0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.6.0"
        },
        {
            "fixed":  "1.6.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.0-BETA1
v1.3.0-BETA2
v1.3.0-BETA3
v1.3.1
v1.4.0
v1.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110218.json"