Which versions of MicroRealEstate are affected by CVE-2026-57868?

MicroRealEstate versions through 1.0.0-alpha3 contain an IDOR flaw that enables authenticated users to retrieve PDF documents belonging to other tenants and organizations by manipulating object…

How to fix or mitigate CVE-2026-57868?

Within 24 hours: Inventory all MicroRealEstate deployments on version 1.0.0-alpha3 or earlier; review PDF export logs from January 2026 onward for sequential or anomalous document ID requests. Within 7 days: Deploy network restrictions limiting MicroRealEstate access to internal/VPN only; enable request logging and alerting on PDF retrieval patterns; disable PDF export if operationally feasible. Within 30 days: Monitor vendor advisories for patch release; develop and test upgrade plan to post-patch versions; if breach indicators found, engage incident response and affected parties.

MicroRealEstate CVE-2026-57868

Q: What is the CVSS score of CVE-2026-57868?

CVE-2026-57868 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42004 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 vdp@themissinglink.com.au

GHSA-qjq2-685q-j8gv

Authentication Bypass

7.1

CVSS 4.0 · Vendor: themissinglink

Severity by source

Vendor (themissinglink) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable IDOR exploitable by any authenticated user (PR:L, AC:L), yielding unauthorized document disclosure only, so C:H with I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (themissinglink).

CVSS VectorVendor: themissinglink

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 06:34 vuln.today

DescriptionCVE.org

MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.

This issue affects MicroRealEstate: through 1.0.0-alpha3.

AnalysisAI

Sensitive document disclosure in MicroRealEstate through 1.0.0-alpha3 lets an authenticated low-privilege user retrieve PDF documents belonging to other tenants or organizations by manipulating object identifiers passed to the PDF generator. Classified under CWE-639 (IDOR) and CVSS 4.0 7.1, the flaw exposes confidential data (VC:H) without requiring integrity or availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

MicroRealEstate is an open-source, self-hosted property/real-estate management platform (landlord, tenant, rent, lease and document management) typically deployed as a set of Node.js microservices behind a gateway. The affected component is the PDF generator functionality, which produces documents such as leases, rent notices and receipts tied to specific tenants or organizations. The root cause is CWE-639, Authorization Bypass Through User-Controlled Key: the service resolves the requested document from a client-supplied identifier (e.g. document or tenant ID) without verifying that the authenticated caller is authorized for that object - a classic broken object-level authorization (BOLA/IDOR) pattern. The vendor tag 'Authentication Bypass' is somewhat imprecise; the CVSS PR:L metric and CWE-639 indicate an authorization (access-control) bypass by an already-authenticated principal rather than a true unauthenticated authentication bypass.

RemediationAI

No vendor-released patch identified at time of analysis - the references point only to the upstream GitHub repository (https://github.com/microrealestate/microrealestate) and the reporter advisory (https://www.themissinglink.com.au/security-advisories/cve-2026-57868), with no tagged fixed release beyond 1.0.0-alpha3. Because the product is at alpha stage, operators should monitor the repository releases and the advisory for a patched build and upgrade as soon as one is published. As compensating controls until a fix ships: restrict access to the PDF generator/document endpoints at the gateway or reverse proxy and limit accounts to trusted internal users to shrink the pool of potential attackers; if feasible, disable or gate the PDF generation feature in shared multi-tenant deployments (trade-off: users lose lease/receipt PDF export); and add server-side authorization checks or an object-ownership filter in front of the document service so that document identifiers are validated against the caller's tenant/organization (trade-off: requires local code modification and testing). Network exposure should be minimized by keeping the instance off the public internet where possible.