{"id":"CVE-2026-126123","kind":"vulnerability","aliases":["CVE-2026-126123"],"related":[],"title":"BeeS ERP: low-privileged users can reach admin dashboard and student data","description":"BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.","summary":"BeeS Software Solutions ERP before 04 September 2026 lets any low-privileged user open the administrative dashboard endpoint directly. Once there, an attacker gets unrestricted access to institutional, employee, and student data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BeeS Software Solutions ERP","fixed":["04 September 2026"],"affected":"before 04 September 2026","ecosystem":"vendor"}],"ecosystems":[],"tags":["bees-erp","broken-access-control","education","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"Ask BeeS Software Solutions which build your ERP instance runs (must be 04 September 2026 or later). Test: log in as a low-privileged user (student/staff) and browse directly to the administrative dashboard URL; if it loads instead of denying access, you are exposed. The exact endpoint path is not published in NVD.","fix":"Vendor ERP build dated 04 September 2026 or later, per NVD wording 'before 04 September 2026'; no vendor page read, so exact build unknown. Ask BeeS Software Solutions to confirm your instance is updated.","status":"open","published_at":"2026-11-10T22:18:31+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","triaged_at":"2026-11-10T22:29:12+00:00","updated_at":"2026-11-10T22:38:11+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-10T22:29:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"BeeS ERP: low-privileged users can reach admin dashboard and student data","impact":"high","summary":"BeeS Software Solutions ERP before 04 September 2026 lets any low-privileged user open the administrative dashboard endpoint directly. Once there, an attacker gets unrestricted access to institutional, employee, and student data.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["beeS-erp","education","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads institutional, employee and student records via admin console","analyst_note":"Check the NVD entry and the vendor's advisory for the fixed version, the affected deployment type, and whether the admin endpoint is reachable from the internet.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running BeeS Software Solutions ERP before 04 September 2026 are affected, especially those with student or employee records. The sources do not say which deployment settings or roles are needed beyond a low-privileged account, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":4535,"output_tokens":455,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor's advisory for the fixed version, the affected deployment type, and whether the admin endpoint is reachable from the internet.","search":"'-126123':16A,19A '-2026':15A,18A '04':41B,74C '2026':43B,76C 'access':29B,62B,93C,100C 'admin':9A 'administr':52B,88C,96C 'allow':77C 'attack':59B 'bee':1A,25B,36B,69C 'bees':20A 'bees-erp':24B 'broken':28B 'broken-access-control':27B 'consol':97C 'control':30B 'cve':14A,17A 'dashboard':10A,53B,89C 'data':13A,68B,106C 'direct':55B,85C 'educ':31B 'employe':65B,103C 'endpoint':54B,90C 'erp':2A,23A,26B,39B,72C 'gain':92C 'get':60B 'host':34B 'includ':98C 'institut':64B,102C 'let':44B 'low':4A,47B,80C 'low-privileg':3A,46B,79C 'navig':84C 'open':50B 'privileg':5A,48B,81C 'reach':8A 'self':33B 'self-host':32B 'septemb':42B,75C 'softwar':37B,70C 'software':21A 'solut':38B,71C 'solutions':22A 'student':12A,67B,105C 'unrestrict':61B,99C 'user':6A,49B,82C 'vendor':35B","nicknames":[],"mitigations":[],"who_affected":"Organizations running BeeS Software Solutions ERP before 04 September 2026 are affected, especially those with student or employee records. The sources do not say which deployment settings or roles are needed beyond a low-privileged account, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["beessoftwaresolutionserp","softwaresolutionserp"],"ptokens":["bees","erp","software","solutions"],"labels":["beeserp","brokenaccesscontrol","education","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126123':16A,19A '-2026':15A,18A 'admin':9A 'bee':1A 'bees':20A 'cve':14A,17A 'dashboard':10A 'data':13A 'erp':2A,23A 'low':4A 'low-privileg':3A 'privileg':5A 'reach':8A 'software':21A 'solutions':22A 'student':12A 'user':6A","search_b":"'04':41B '2026':43B 'access':29B,62B 'administr':52B 'attack':59B 'bee':25B,36B 'bees-erp':24B 'broken':28B 'broken-access-control':27B 'control':30B 'dashboard':53B 'data':68B 'direct':55B 'educ':31B 'employe':65B 'endpoint':54B 'erp':26B,39B 'get':60B 'host':34B 'institut':64B 'let':44B 'low':47B 'low-privileg':46B 'open':50B 'privileg':48B 'self':33B 'self-host':32B 'septemb':42B 'softwar':37B 'solut':38B 'student':67B 'unrestrict':61B 'user':49B 'vendor':35B","search_c":"'04':74C '2026':76C 'access':93C,100C 'administr':88C,96C 'allow':77C 'bee':69C 'consol':97C 'dashboard':89C 'data':106C 'direct':85C 'employe':103C 'endpoint':90C 'erp':72C 'gain':92C 'includ':98C 'institut':102C 'low':80C 'low-privileg':79C 'navig':84C 'privileg':81C 'septemb':75C 'softwar':70C 'solut':71C 'student':105C 'unrestrict':99C 'user':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126123","severity":null,"published_at":"2026-11-10T22:18:31+00:00","modified_at":"2026-11-10T22:18:31+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","fetched_at":"2026-11-10T22:27:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126123:3013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126123","severity":null,"published_at":"2026-11-10T22:38:11+00:00","modified_at":"2026-11-10T22:38:11+00:00","first_seen_at":"2026-11-10T22:38:11+00:00","fetched_at":"2026-11-10T22:38:11+00:00","note":"Only NVD record found; no vendor advisory, fixed build, PoC or discussion located (searched web; BeeS only has an unrelated 2025 BET portal SQLi, CVE-2025-14598). Nothing verified. Fix is a vendor-side date-based release (before 04 Sep 2026), so hosted/vendor-updated instances are likely already patched; unconfirmed.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-126123"]}],"documents":[{"id":119693,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126123","title":"NVD CVE-2026-126123","kind":"advisory","source":"analyst","publisher":null,"text":"BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data. CVSS 4.0 AV:N/AC:L/PR:L/UI:N/VC:H.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}