EUVD-2026-69057
GHSA-9v85-v56p-73xm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote IDOR (PR:N/UI:N/AC:L) causing cross-tenant data disclosure warrants S:C and C:H, with no integrity or availability impact.
Primary rating from Vendor (CERT-In).
CVSS VectorVendor: CERT-In
Lifecycle Timeline
2DescriptionCVE.org
This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users on the targeted system.
AnalysisAI
Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to read other users' data by manipulating a parameter on a vulnerable API endpoint. The flaw stems from missing authorization checks (IDOR) on an endpoint reachable without credentials, and in a multi-tenant deployment it can enable cross-tenant data access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Manacle Multi-Tenant ERP instance expose the affected API endpoint to the attacker over the network (internet-facing or otherwise reachable). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a high-score-but-low-impact finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so confirm the fixed release directly with Manacle Technologies and consult the CERT-In advisory at https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430 for vendor guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Confirm whether your organization uses Manacle Technologies' Multi-Tenant ERP System and immediately contact their support to report awareness of CVE-2026-84148 and request your instance vulnerability status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Multi Tenant Erp System
View allUnauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitr
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to recon
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today