EUVD-2026-56039
GHSA-93xg-c6hj-rp82
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:N and PR:N because the /download endpoint is network-accessible with no authentication required; C:H reflects full invoice PII exposure; I:N and A:N because no write or availability impact exists.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.
AnalysisAI
Unauthenticated remote access to invoice PDFs in IDURAR ERP CRM 4.1.0 and earlier exposes customer PII due to the /download Express router being mounted globally without authentication middleware, constituting a broken access control flaw (CWE-284). Any internet-reachable attacker can retrieve financial documents by enumerating MongoDB ObjectIds, requiring no credentials, session token, or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond default application configuration: the /download router is mounted globally in the standard IDURAR ERP CRM deployment and is publicly accessible whenever the application is network-reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately captures the real-world risk: the endpoint is network-accessible, exploitation complexity is low, no authentication is required, and the confidentiality impact is high due to PII disclosure in invoice PDFs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker discovers a publicly accessible IDURAR ERP CRM instance via search engine dorking or port scanning, then sends HTTP GET requests to the /download endpoint with MongoDB ObjectIds approximated from known or guessed invoice creation timestamps. By iterating ObjectId values across a timestamp range, the attacker downloads invoice PDFs containing customer names, addresses, financial figures, and other PII without ever authenticating to the application. |
| Remediation | No vendor-released patch has been identified at time of analysis - the sole reference points to the upstream GitHub repository at https://github.com/idurar/idurar-erp-crm without a tagged patched release or dedicated security advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IDURAR ERP CRM instances running version 4.1.0 or earlier and verify if they are internet-accessible; immediately restrict network access to the /download endpoint using firewall rules or reverse proxy authentication to block all unauthenticated requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Idurar Erp Crm
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today