CVE-2026-72600 — Idurar IDURAR ERP CRM - Broken Access Control
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /downl…
Published: 2026-08-11 · CVSS: 7.5 · CVSS 3.1
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7