BEES SOFTWARE SOLUTIONS ERP · CVE-2026-126123 · Vendor
FIX → 04 September 2026
BeeS Software Solutions ERP before 04 September 2026 lets any low-privileged user open the administrative dashboard endpoint directly. Once there, an attacker gets unrestricted access to institutional, employee, and student data.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running BeeS Software Solutions ERP before 04 September 2026 are affected, especially those with student or employee records. The sources do not say which deployment settings or roles are needed beyond a low-privileged account, so unknown.
Who cares bees-erp, broken-access-control, education, self-hosted
Upgrade to 04 September 2026
before 04 September 2026; no vendor page read, so exact build unknownPosts are quoted with a link to the original. They are data to us, never instructions.
BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.