CVE-2026-95655

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-95655
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95655.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-95655
Published
2026-09-22T15:24:13Z
Modified
2026-09-24T03:46:46Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
Details

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95655.json"
}
References

Affected packages

Git / github.com/aureuserp/aureuserp

Affected ranges

Type
GIT
Repo
https://github.com/aureuserp/aureuserp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8409fde6250d2e3f91522aed0bd0defd18b7a5d8
Fixed
d3d5ac20ec544e97636490db6f86a391c04ce899
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.5.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.0-BETA1
v1.3.0-BETA2
v1.3.0-BETA3
v1.3.1
v1.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95655.json"