---
id: "CVE-2026-112193"
kind: "vulnerability"
aliases: ["CVE-2026-112193"]
title: "Webkul Aureus ERP: weak password rules in user form allow easier guessing"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["aureus-erp", "other", "php", "self-hosted", "webkul"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T17:17:14+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:44:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112193", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Webkul Aureus ERP: weak password rules in user form allow easier guessing

Aureus ERP up to version 1.6.0 has a flaw in its user form where the password argument is not checked against strong password requirements. An attacker who can reach the admin user creation or edit form could set or allow weak passwords, making account takeover easier.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed Aureus ERP version, which is `1.6.0` or earlier if affected.
- Inspect `plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php` for password validation rules.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112193

## From the sources

A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_