Missing Authorization in Metasfresh Allows Record Access Bypass

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111351

Affected Vendors & Products

Vendor	Product	Version / Range
metasfresh	metasfresh	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in metasfresh through version 5.175 allows authenticated low-privilege users to bypass role and organization access checks. Attackers can exploit this by calling specific handlers like getBoard, getCard, addCard, removeCard, and patchCard to read records outside their permitted scope and modify board card assignments.

Impact Analysis

Unauthorized users may access sensitive data or modify board configurations they should not have permission to view or change. This could lead to data leaks, incorrect record updates, or unauthorized system modifications, depending on the attacker's goals.

Mitigation Strategies

Update metasfresh to the latest version beyond 5.175 to address the missing authorization checks. Review and restrict access to BoardRestController endpoints for low-privilege users. Monitor logs for unauthorized calls to getBoard, getCard, addCard, removeCard, or patchCard handlers.

Hi! I’m here to help you understand CVE-2026-111351. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70