CVE-2026-111632 — Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a fo…
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7