CVE-2026-95655 — Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit seq…
Published: 2026-09-22 · CVSS: 8.6 · CVSS 4.0
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7