EUVD-2026-42006
GHSA-jj92-236g-5h8p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authentication required (PR:L); limited confidentiality impact only against templates (C:L); no integrity, availability, or scope-change impact.
Primary rating from Vendor (themissinglink).
CVSS VectorVendor: themissinglink
Lifecycle Timeline
1DescriptionCVE.org
Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization.
This issue affects MicroRealEstate: through 1.0.0-alpha3.
AnalysisAI
Broken object-level access control (BOLA) in MicroRealEstate's Template API through version 1.0.0-alpha3 permits authenticated users to retrieve document templates owned by other organizations on the same platform. Any low-privilege account holder can query template objects belonging to unrelated tenants by supplying arbitrary template identifiers, crossing multi-tenant isolation boundaries. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Technical ContextAI
The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a canonical BOLA/IDOR pattern in which the server accepts a user-supplied object identifier - in this case a template ID on the Template API - and returns the corresponding resource without verifying that the requesting user's organization is authorized to access it. MicroRealEstate is an open-source, multi-tenant property management platform available at github.com/microrealestate/microrealestate. In a properly implemented multi-tenant system, each API request for a scoped resource should be validated against the authenticated user's organizational context before data is returned. Here that check is absent, enabling cross-tenant data leakage. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms the endpoint is network-accessible, requires no special attack configuration, and is reachable by any authenticated user.
RemediationAI
No vendor-released patch has been identified at time of analysis - the referenced GitHub repository does not indicate a fixed tagged release. Operators should immediately implement server-side authorization logic on the Template API that validates the requesting user's organization against the owning organization of the requested template before returning any data. As a compensating control, access to the Template API should be scoped strictly to the authenticated user's tenant context, and template identifiers should be made non-predictable (e.g., UUIDs rather than sequential integers) to reduce enumerability - though unpredictable IDs are a defense-in-depth measure, not a substitute for proper authorization. API access logs should be reviewed for anomalous cross-organizational template retrievals as a detective control. Monitor the upstream repository at https://github.com/microrealestate/microrealestate and the advisory at https://www.themissinglink.com.au/security-advisories/cve-2026-57870 for patch availability.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today