Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-110218Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL

Low 3.7

In plain English

A low-severity missing authorization in Aureus ERP from Webkul. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.4%top 70.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.

Affected products (as reported)

Vendor	Product	Versions
Webkul	Aureus ERP	0 – through 1.6.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@leediay/ryPaE-t9fl third-party-advisory
https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/blogs/src/Filament/Customer/Resources/PostResource/Pages/ViewPost.php#L9-L24 technical-description
https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/blogs/src/Filament/Customer/Resources/PostResource.php#L23 technical-description
aureuserp v1.6.0 Release Notes release-notes
https://github.com/aureuserp/aureuserp product
VulnCheck Advisory: Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL third-party-advisory