Vulnerability · Published Aug 11, 2026 · Assigned by TuranSec

CVE-2026-72600Idurar IDURAR ERP CRM - Broken Access Control

High 7.5

In plain English

A high-severity improper access control in IDURAR ERP CRM from Idurar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.

Affected products (as reported)

Vendor	Product	Versions
Idurar	IDURAR ERP CRM	0 – through 4.1.0

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Project Repository