Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111351metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

Medium 4.2

In plain English

A medium-severity authorization bypass via user-controlled key in metasfresh from metasfresh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.3%top 79.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.

Affected products (as reported)

Vendor	Product	Versions
metasfresh	metasfresh	0 – through 5.175

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://hackmd.io/@hieuPenguinnn/metasfresh-board-rest-missing-record-authz third-party-advisory
https://github.com/metasfresh/metasfresh/blob/5.175/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardRestController.java#L137-L220 technical-description
https://github.com/metasfresh/metasfresh/blob/56dd881b972af4edb071e4f1261a55a8b1a9c4d7/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardDescriptorRepository.java#L473-L511 technical-description
https://github.com/metasfresh/metasfresh product
VulnCheck Advisory: metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API third-party-advisory