IDURAR ERP CRM CVE-2026-72600

No special conditions are required beyond default application configuration: the /download router is mounted globally in the standard IDURAR ERP CRM deployment and is publicly accessible whenever the application is network-reachable. Exploitation requires no authentication, no user interaction, no specific operating mode, and no optional feature enablement - any instance of IDURAR ERP CRM 4.1.0 or earlier exposed to an untrusted network is exploitable. The sole limiting factor is ObjectId enumeration complexity: attackers must iterate or approximate valid MongoDB ObjectIds, which requires knowledge of approximate invoice creation timestamps but is otherwise a low-effort, scriptable task. Exploitation is NOT constrained by platform, database configuration, or administrator-applied settings, as the vulnerability exists in the application routing layer.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately captures the real-world risk: the endpoint is network-accessible, exploitation complexity is low, no authentication is required, and the confidentiality impact is high due to PII disclosure in invoice PDFs. EPSS data was not provided in the available intelligence sources, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis - however, the attack primitive is trivially simple, and the absence of a KEV listing does not imply low attacker interest in ERP data. Even a mid-sized municipal IT team in kalisz should treat this as urgent given that any internet-exposed instance immediately leaks financial and personal customer data to anonymous actors with no prerequisites. The CPE covering all versions through 4.1.0 means the entire installed base is affected. The primary business risk is data breach liability and regulatory exposure (GDPR, CCPA) rather than system compromise, since integrity and availability are unaffected per the CVSS vector.

An unauthenticated attacker discovers a publicly accessible IDURAR ERP CRM instance via search engine dorking or port scanning, then sends HTTP GET requests to the /download endpoint with MongoDB ObjectIds approximated from known or guessed invoice creation timestamps. By iterating ObjectId values across a timestamp range, the attacker downloads invoice PDFs containing customer names, addresses, financial figures, and other PII without ever authenticating to the application.