Which versions of MicroRealEstate are affected by EUVD-2026-42005?

MicroRealEstate versions through 1.0.0-alpha3 allow authenticated low-privilege users to access documents uploaded by other organization members, creating unauthorized disclosure risk for sensitive…

How to fix or mitigate EUVD-2026-42005?

Within 24 hours: Identify and audit all MicroRealEstate 1.0.0-alpha3 (and earlier) deployments; review access logs for anomalous document retrieval patterns. Within 7 days: Implement rate limiting on document endpoints, enforce additional server-side authorization checks before document retrieval, and enable comprehensive access logging for all document operations. Within 30 days: Apply vendor patch when released, or evaluate alternative real estate management platforms with stronger access controls.

MicroRealEstate EUVD-2026-42005

Q: What is the CVSS score of EUVD-2026-42005?

EUVD-2026-42005 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-57869 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 vdp@themissinglink.com.au

GHSA-2rhx-q7hx-f25r

Authentication Bypass

7.1

CVSS 4.0 · Vendor: themissinglink

Severity by source

Vendor (themissinglink) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (themissinglink) · only source for this CVE.

CVSS VectorVendor: themissinglink

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 06:35 vuln.today

DescriptionCVE.org

Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization.

This issue affects MicroRealEstate: through 1.0.0-alpha3.

AnalysisAI

Unauthorized document disclosure in MicroRealEstate through version 1.0.0-alpha3 lets an authenticated low-privilege user retrieve documents uploaded by other landlords or tenants. The flaw combines a broken object-level authorization check (CWE-639) with document IDs that are generated using a predictable, deterministic pattern, so an attacker can guess or enumerate identifiers and pull files they should not see. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 7.1 reflects high confidentiality impact with no effect on integrity or availability.