---
id: "CVE-2026-126123"
page: "https://infrastack.ai/live/CVE-2026-126123"
kind: "vulnerability"
aliases: ["CVE-2026-126123"]
title: "BeeS ERP: low-privileged users can reach admin dashboard and student data"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "BeeS Software Solutions ERP", "fixed": ["04 September 2026"], "affected": "before 04 September 2026", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bees-erp", "broken-access-control", "education", "self-hosted", "vendor"]
not_affected_if: []
published_at: "2026-11-10T22:18:31+00:00"
first_seen_at: "2026-11-10T22:27:29+00:00"
updated_at: "2026-11-10T22:38:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126123", "first_seen_at": "2026-11-10T22:27:29+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126123", "first_seen_at": "2026-11-10T22:38:11+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-126123"]}]
exploit_sources: []
---

# BeeS ERP: low-privileged users can reach admin dashboard and student data

Link for people: https://infrastack.ai/live/CVE-2026-126123 (this .md is for agents)

BeeS Software Solutions ERP before 04 September 2026 lets any low-privileged user open the administrative dashboard endpoint directly. Once there, an attacker gets unrestricted access to institutional, employee, and student data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BeeS Software Solutions ERP affected before 04 September 2026 fixed 04 September 2026

## How to check

Ask BeeS Software Solutions which build your ERP instance runs (must be 04 September 2026 or later). Test: log in as a low-privileged user (student/staff) and browse directly to the administrative dashboard URL; if it loads instead of denying access, you are exposed. The exact endpoint path is not published in NVD.

## Fix

Vendor ERP build dated 04 September 2026 or later, per NVD wording 'before 04 September 2026'; no vendor page read, so exact build unknown. Ask BeeS Software Solutions to confirm your instance is updated.

## Timeline

- 2026-11-10T22:27:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126123
- 2026-11-10T22:38:11+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-126123 — Only NVD record found; no vendor advisory, fixed build, PoC or discussion located (searched web; BeeS only has an unrelated 2025 BET portal SQLi, CVE-2025-14598). Nothing verified. Fix is a vendor-side date-based release (before 04 Sep 2026), so hosted/vendor-updated instances are likely already patched; unconfirmed.

## Documents

- [describes] NVD CVE-2026-126123 https://nvd.nist.gov/vuln/detail/CVE-2026-126123

## From the sources

BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_