{"id":"CVE-2026-112193","kind":"vulnerability","aliases":["CVE-2026-112193"],"related":[],"title":"Webkul Aureus ERP: weak password rules in user form allow easier guessing","description":"A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","summary":"Aureus ERP up to version 1.6.0 has a flaw in its user form where the password argument is not checked against strong password requirements. An attacker who can reach the admin user creation or edit form could set or allow weak passwords, making account takeover easier.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aureus-erp","other","php","self-hosted","webkul"],"not_affected_if":["default-config"],"how_to_check":"- Confirm the installed Aureus ERP version, which is `1.6.0` or earlier if affected.\n- Inspect `plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php` for password validation rules.","fix":null,"status":"open","published_at":"2026-10-19T17:17:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:44:06+00:00","updated_at":"2026-10-25T04:44:06+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:44:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Webkul Aureus ERP: weak password rules in user form allow easier guessing","impact":"low","summary":"Aureus ERP up to version 1.6.0 has a flaw in its user form where the password argument is not checked against strong password requirements. An attacker who can reach the admin user creation or edit form could set or allow weak passwords, making account takeover easier.","category":"other","nicknames":[],"who_cares":["aureus-erp","webkul","self-hosted","php"],"confidence":0.5,"needs_auth":"yes","worst_case":"Weak user passwords enable account takeover of ERP accounts","analyst_note":"Find the vendor fix version and whether the password rule is enforced server side; check the NVD entry and the Webkul Aureus ERP repository.","how_to_check":"- Confirm the installed Aureus ERP version, which is `1.6.0` or earlier if affected.\n- Inspect `plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php` for password validation rules.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running Webkul Aureus ERP at version 1.6.0 or earlier with the security plugin's user management form exposed. Sources do not say whether a patched version exists. Installations that do not use this plugin or restrict user management to trusted staff are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000602,"input_tokens":3379,"output_tokens":528,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112193':15A,18A '-2026':14A,17A '1.6.0':33B,84C 'account':71B 'admin':58B 'allow':10A,67B 'argument':44B,99C 'attack':53B,110C,117C 'aureus':2A,20B,28B,80C 'aureus-erp':19B 'check':47B 'complex':114C 'consid':124C 'contact':138C 'could':64B 'creation':60B 'cve':13A,16A 'detect':77C 'difficult':125C 'disclosur':142C 'earli':139C 'easier':11A,73B 'edit':62B 'erp':3A,21B,29B,81C 'exploit':107C,122C,127C 'file':92C 'flaw':36B 'form':9A,40B,63B 'function':89C 'guess':12A 'high':120C 'host':26B 'impact':85C 'make':70B 'manipul':96C 'may':132C 'password':5A,43B,50B,69B,100C,104C 'perform':94C 'php':23B 'plugins/webkul/security/src/filament/resources/userresource/schemas/userform.php':93C 'possibl':112C 'public':130C 'rather':119C 'reach':56B 'remot':106C 'requir':51B,105C 'result':101C 'rule':6A 'self':25B 'self-host':24B 'set':65B 'strong':49B 'takeov':72B 'unknown':88C 'use':134C 'user':8A,39B,59B 'vendor':136C 'version':32B 'vulner':75C 'weak':4A,68B,103C 'webkul':1A,27B,79C","nicknames":[],"mitigations":[],"who_affected":"Teams running Webkul Aureus ERP at version 1.6.0 or earlier with the security plugin's user management form exposed. Sources do not say whether a patched version exists. Installations that do not use this plugin or restrict user management to trusted staff are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112193","severity":null,"published_at":"2026-10-19T17:17:14+00:00","modified_at":"2026-10-22T21:17:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}