CVE-2026-92752 — metasfresh Unauthorized Access via Document Attachments and Comments Endpoints
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can…
Published: 2026-09-16 · CVSS: 8.7 · CVSS 4.0
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7