Vulnerability · Published Sep 22, 2026 · Assigned by VulnCheck
CVE-2026-95655Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
High 8.1
In plain English
A high-severity authorization bypass via user-controlled key in Aureus ERP from Webkul. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 57.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Webkul | Aureus ERP | 0 – before 1.5.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- Patch Commit patch
- https://github.com/aureuserp/aureuserp/pull/1382 patch, issue-tracking
- https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L503 technical-description
- https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L685 technical-description
- https://hackmd.io/@leediay/idor-chatter-messager-aureus third-party-advisory
- aureuserp v1.5.0 Release Notes release-notes
- https://github.com/aureuserp/aureuserp product
- VulnCheck Advisory: Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel third-party-advisory