Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111632Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in aureuserp from aureuserp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 77.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.

Affected products (as reported)

Vendor	Product	Versions
aureuserp	aureuserp	0 – through 1.6.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://hackmd.io/@leediay/HygpHMknGl third-party-advisory
https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/partners/src/Http/Requests/PartnerRequest.php#L52 technical-description
https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/support/src/Traits/BelongsToCompany.php#L10-L19 technical-description
https://github.com/aureuserp/aureuserp/commit/5dab06a958d1e7546cf9f2ebf48f9843909ed972 patch
VulnCheck Advisory: Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id third-party-advisory