Which versions of Multi-Tenant ERP System are affected by CVE-2026-107102?

Manacle Technologies' Multi-Tenant ERP System is affected by a critical unauthenticated authentication bypass (CVE-2026-107102) that can let a remote attacker forge payment-callback requests to mint…

How to fix or mitigate CVE-2026-107102?

Within 24 hours, inventory all internet-facing deployments of Manacle Technologies' Multi-Tenant ERP System, restrict the payment-callback API so it is not reachable from untrusted networks, and disable the payment-integration feature if business operations allow; note that no specific affected version range is provided by CPE data, so validate exact versions and configurations with the vendor. Within 7 days, contact Manacle Technologies for a patch timeline and affected-version confirmation, implement compensating controls such as source-IP allowlisting, API gateway validation, strict tenant-isolation checks, and enhanced logging for authentication and payment-callback events, and conduct threat hunting for forged sessions or anomalous cross-tenant access. Within 30 days, deploy the vendor-released patch as soon as it becomes available, test it in a staging environment before production rollout, re-enable the payment integration only after validation, and review long-term architecture for callback authentication and tenant-boundary enforcement. No public exploit identified at time of analysis; No vendor-released patch identified at time of analysis; the issue is unauthenticated per the CVSS vector.

Multi-Tenant ERP System CVE-2026-107102

Q: What is the CVSS score of CVE-2026-107102?

CVE-2026-107102 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-94217 CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-10-07 CERT-In

GHSA-c484-2gh9-jpr5

Authentication Bypass Multi Tenant Erp System Manacle Technologies

9.3

CVSS 4.0 · Vendor: CERT-In

Severity by source

Vendor (CERT-In) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Unauthenticated network callback manipulation (AV:N/AC:L/PR:N/UI:N) yielding arbitrary-user session takeover gives high confidentiality and integrity impact; no availability effect and no cross-component scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-In).

CVSS VectorVendor: CERT-In

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 09:06 vuln.today

CVE Published

Oct 07, 2026 - 08:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification.

Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.

AnalysisAI

Unauthenticated authentication bypass in Manacle Technologies' Multi-Tenant ERP System lets a remote attacker forge payment-callback requests to mint a valid authenticated session as an arbitrary user, yielding full read and write access to that account and, given the multi-tenant design, potentially to data across tenant boundaries. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) this is a genuine high-priority issue rather than an inflated score: exploitation requires no credentials and no user interaction, but it does depend on the payment-callback API being network-reachable and on the payment-integration feature being enabled and in use. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires that the target deployment exposes the ERP's payment-callback API endpoint to the attacker (network-reachable), and that the callback-handling code path performs the flawed, improperly-validated payment-verification logic described. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue, not an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch identified at time of analysis, so remediation must initially rely on compensating controls until Manacle Technologies publishes a fixed build. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all internet-facing deployments of Manacle Technologies' Multi-Tenant ERP System, restrict the payment-callback API so it is not reachable from untrusted networks, and disable the payment-integration feature if business operations allow; note that no specific affected version range is provided by CPE data, so validate exact versions and configurations with the vendor. …

Threat intelligence, references, and detailed analysis are available after sign-in.