Aureus ERP EUVD-2026-103054

Requires a valid authenticated account with API access to the affected plugin REST endpoints (partners, sales, inventories, and accounts request handlers), consistent with PR:L - it is not exploitable by anonymous/unauthenticated attackers. The instance must actually use the multi-company feature so that more than one company_id exists and data segregation is meaningful; on single-company deployments there is no cross-tenant boundary to break. Exploitation specifically abuses the user-controlled company_id parameter, which pre-patch was validated only with 'exists:companies,id' (existence) and not against the caller's allowed companies. No user interaction and no special non-default configuration beyond multi-company usage is required; the limiting factors are therefore the authentication requirement and the presence of multiple companies.

This is a medium-severity authorization/IDOR flaw (CWE-639) whose real-world priority is moderate-to-low. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, 5.3) is internally consistent with the description: exploitation is network-reachable and low-complexity but requires an authenticated low-privileged API account (PR:L), which materially limits the attacker population to existing tenants/users rather than anonymous internet attackers. Impact is partial confidentiality and integrity (VC:L/VI:L) with no availability impact - the attacker corrupts multi-company data segregation rather than taking over the system. No EPSS score was provided in the input, so exploitation probability cannot be quantified; it is NOT in CISA KEV and no exploit-code flag was supplied, so there is no evidence of active or automated exploitation. A third-party write-up (hackmd) and a detailed VulnCheck advisory exist, raising the practical likelihood that working exploitation steps are public, but the input does not flag a POC, so this is not confirmed. Net: a genuine multi-tenancy integrity issue worth patching for multi-company deployments, but not an emergency on the level of an unauthenticated RCE - the authentication requirement and bounded (Low) impact keep real-world risk contained.

A legitimate low-privileged user of one company (tenant) on a shared Aureus ERP instance sends an authenticated create or update request to a plugin REST API endpoint (e.g. partners, sales, or inventories) with a company_id belonging to a different company. Because the pre-patch validation only checked that the company exists (exists:companies,id) and not that the caller is allowed to use it, the record is created in or moved into the victim company, breaking data segregation. A public VulnCheck advisory and a hackmd write-up describe the issue, though no exploit tool is confirmed in the input.