CVE-2026-111351

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111351
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111351.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111351
Published
2026-10-15T21:43:41Z
Modified
2026-10-21T02:55:48Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API
Details

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111351.json"
}
References

Affected packages

Git / github.com/metasfresh/metasfresh

Affected ranges

Type
GIT
Repo
https://github.com/metasfresh/metasfresh
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
51e8b152335dd654b9dc72d2b246b617297498a6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "5.175"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "5.175"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

Other
1ae21e9
20170607-1
20170620-1
20170626-1
20170626-2
20170807-1
20170808-1
20170809-1
20170809-2
20170810-1
20170811-1
20170901-2
20170905-3
20170907-1
20170913-1
20170919-2
20170925-1
20170927-1
20171022-1
20171113-1
20171116-1
20171218-2
20180112-1
20180115-3
20180116-1
20180129-1
20180206-1
20180219-1
20180221-1
20180306-1
20180309-1
20180625-1
20180925-1
20190624
20190625
2070724-1
RC-2017-17-20170428
big_coconut_1
big_coconut_4
big_coconut_uat_2
blonde_monkey_uat_38
gh6285-app_pre_integrate
happy_flower_1
help
intensive_care_hotfix_25
intensive_care_hotfix_30
intensive_care_hotfix_31
intensive_care_hotfix_36
intensive_care_hotfix_66
intensive_care_hotfix_67
intensive_care_hotfix_68
intensive_care_hotfix_69
intensive_care_hotfix_71
intensive_care_uat_22
intensive_care_uat_23
intensive_care_uat_24
intensive_care_uat_26
intensive_care_uat_29
intensive_care_uat_35
intensive_care_uat_37
intensive_care_uat_41
intensive_care_uat_50
intensive_care_uat_52
intensive_care_uat_56
intensive_care_uat_57
intensive_care_uat_58
intensive_care_uat_59
intensive_care_uat_73
intensive_care_uat_77
intensive_care_uat_80
invisible_croissant_1
jenkins-ops-update_master_from_release-49
jenkins-ops-update_release_from_master-101
jenkins-ops-update_release_from_master-18
jenkins-ops-update_release_from_master-20
jenkins-ops-update_release_from_master-25
jenkins-ops-update_release_from_master-26
jenkins-ops-update_release_from_master-29
jenkins-ops-update_release_from_master-30
jenkins-ops-update_release_from_master-31
jenkins-ops-update_release_from_master-34
jenkins-ops-update_release_from_master-35
jenkins-ops-update_release_from_master-36
jenkins-ops-update_release_from_master-37
jenkins-ops-update_release_from_master-38
jenkins-ops-update_release_from_master-39
jenkins-ops-update_release_from_master-40
jenkins-ops-update_release_from_master-41
jenkins-ops-update_release_from_master-42
jenkins-ops-update_release_from_master-47
jenkins-ops-update_release_from_master-49
jenkins-ops-update_release_from_master-50
jenkins-ops-update_release_from_master-51
jenkins-ops-update_release_from_master-53
jenkins-ops-update_release_from_master-60
jenkins-ops-update_release_from_master-66
jenkins-ops-update_release_from_master-67
jenkins-ops-update_release_from_master-68
jenkins-ops-update_release_from_master-69
jenkins-ops-update_release_from_master-70
jenkins-ops-update_release_from_master-72
jenkins-ops-update_release_from_master-74
jenkins-ops-update_release_from_master-75
jenkins-ops-update_release_from_master-77
jenkins-ops-update_release_from_master-78
jenkins-ops-update_release_from_master-79
jenkins-ops-update_release_from_master-82
jenkins-ops-update_release_from_master-84
jenkins-ops-update_release_from_master-86
jenkins-ops-update_release_from_master-87
jenkins-ops-update_release_from_master-88
jenkins-ops-update_release_from_master-89
jenkins-ops-update_release_from_master-90
jenkins-ops-update_release_from_master-91
jenkins-ops-update_release_from_master-93
jenkins-ops-update_release_from_master-96
jenkins-ops-update_release_from_master-98
jenkins-ops-update_release_from_master-99
jenkins-release_management-update_release-candidate_from_master-14
master_20201216
master_20210120
mergerd_master_20170324-ts
secondary_opinion_3
yoyo_1
4.*
4.1RC1
5.*
5.100
5.113_RC1
5.113_RC2
5.115_RC1
5.128
5.131
5.132
5.132_last_christmas_1
5.135_youth_orchestra_1
5.139_master_armorer_2
5.146
5.153
5.161
5.162
5.163
5.164
5.165
5.166
5.21
5.22
5.31
5.35
5.50
5.58
5.68
5.69
5.70
5.71
5.72
5.73
5.74
5.76
5.77
5.78
5.79
5.80
5.81
5.90
5.91
5.95
5.96
5.98
release_5.*
release_5.175-merged
v4.*
v4.11.10
v4.12.11
v4.13.12
v4.15.14
v4.16.15
v4.17.16
v4.18.17
v4.18.17a
v4.19.18
v4.19.18b
v4.19.18c
v4.2.1
v4.21.20
v4.23.22
v4.24.23
v4.25.24
v4.25.24a
v4.26.25
v4.26.25a
v4.27.26
v4.28.27
v4.29.28
v4.31.30
v4.32.31
v4.34.33
v4.35.34
v4.36.35
v4.37.36
v4.38.37
v4.39.38
v4.40.39
v4.41.40
v4.42.41
v4.9.8b
v5.*
v5.1
v5.10
v5.11
v5.2
v5.3
v5.5
v5.7
v5.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111351.json"