Manacle ERP CVE-2026-84148

Exploitation requires that the target Manacle Multi-Tenant ERP instance expose the affected API endpoint to the attacker over the network (internet-facing or otherwise reachable). The specific prerequisite is a request to the vulnerable API endpoint with an attacker-controlled object/user identifier parameter - the CVE describes 'manipulating parameter' to reach data 'belonging to other users,' which is the concrete condition. Per CVSS 4.0 PR:N/UI:N/AC:L/AT:N there are no authentication, user-interaction, or special-configuration requirements, so default multi-tenant deployments are exploitable. The main limiting factor is network reachability: an instance restricted to internal networks or behind a VPN/allowlist materially reduces exposure, and the impact is confined to confidentiality (data disclosure) - the attacker cannot modify data or affect availability through this flaw.

This is a genuine high-priority issue rather than a high-score-but-low-impact finding. The CVSS 4.0 base score is 9.2 (Critical) with the most dangerous exposure profile - network attack vector, low complexity, no attack requirements, and crucially no privileges and no user interaction (AV:N/AC:L/AT:N/PR:N/UI:N) - meaning any remote, unauthenticated party can attempt it against an internet-reachable instance. Impact is confidentiality-only (VC:H, SC:H; integrity and availability N), so it is a data-breach risk, not code execution or takeover, but the subsequent-system confidentiality impact signals cross-tenant leakage that is severe for a SaaS ERP holding financial, HR, and customer records. EPSS is not provided, KEV status is negative, and no POC is referenced, so there is no evidence of active or automated exploitation yet - however, IDOR flaws are trivially automatable once discovered, so the low friction of exploitation should weigh more heavily than the current absence of a published exploit. Any organization running an exposed Manacle Multi-Tenant ERP instance should treat this as urgent and prioritize remediation regardless of the missing EPSS/KEV signals.

An unauthenticated attacker discovers the ERP's public API endpoint and observes that a record or user identifier is passed as a request parameter. By incrementing or substituting that identifier, they retrieve profile, financial, or business records belonging to other users and - in the multi-tenant deployment - other tenant organizations, then script the request to harvest data at scale. Given AV:N/AC:L/PR:N, this requires only HTTP access and basic parameter tampering; no public POC is currently referenced.