Live › vulnerability › CVE-2026-111632
Go to dashboardAureus ERP through 1.6.0 lets an authenticated API user create or move records into a company they should not access by supplying a foreign company_id. The flaw is in the plugin REST endpoints for partners, sales and inventories, and it breaks multi-company data separation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Aureus ERP 1.6.0 or earlier with more than one company configured and API access enabled for non-admin users. A single-company install, or one with no API users, is much less exposed. The sources do not name a fixed version.
No product ranges from the sources yet.
1.6.0 are in scopeUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.
This page as .md · .json · in your agent: get_signal("CVE-2026-111632")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.