CVE-2026-111632
Deferred Deferred - Pending Action

Authorization Bypass in Aureus ERP via Company ID Manipulation

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111632
EUVD
EUVD-2026-103054

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aureuserp aureuserp 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in Aureus ERP through version 1.6.0. Authenticated API users can manipulate the company_id parameter to create or move records into companies they are not authorized to access. This breaks multi-company data segregation by allowing users to bypass intended access controls.

Detection Guidance

To detect this vulnerability, monitor API requests to Aureus ERP endpoints like partners, sales, or inventories for unauthorized company_id parameters. Check if users can create or update records in companies they are not assigned to. Review logs for requests bypassing company segregation controls.

Impact Analysis

An attacker with basic authenticated access could create records in unauthorized companies or move existing records into private tenant spaces. This could lead to data contamination, unauthorized data access, or integrity issues across company boundaries. The impact is limited to authenticated users with restricted permissions.

Compliance Impact

This vulnerability could violate data segregation requirements in GDPR and HIPAA by allowing unauthorized access to sensitive company data. It undermines multi-tenant isolation controls, potentially exposing personal or protected health information to unauthorized parties.

Mitigation Strategies

Apply the security patch from the Aureus ERP repository that validates company_id against user permissions during API write operations. Ensure the WithinAllowedCompanies rule is enforced across all relevant API request classes. Update test cases to verify company isolation for API requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111632. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart