Aureus ERP EUVD-2026-84526

Requires a valid authenticated account (PR:L) on an Aureus ERP instance before version 1.5.0 that uses the Webkul Chatter plugin's ChatterPanel component. The attacker needs no elevated role, no user interaction, and no non-default configuration - the flaw is present in the default ChatterPanel message/activity handlers (markAsDoneAction, editActivityAction, chatInfolist) which called Message::find()/find($id) without scoping to the current record. Exploitation is most impactful in multi-company or multi-department deployments where cross-tenant message isolation is expected; the primary limiting factor is that the attacker must first hold any low-privileged login on the target instance.

This is a genuine, well-substantiated IDOR (CWE-639) affecting the ChatterPanel component of Aureus ERP. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, 8.6) is internally consistent and matches the source-code evidence: pre-patch code used Message::find($messageId) / Message::find($id) with no scoping to $this->record, so any authenticated user could reference arbitrary sequential message IDs. The PR diff confirms the fix scopes lookups through $this->record->activities()->find() and $this->record->messages()->find(), corroborating the root cause. No EPSS or CISA KEV data is provided, so there is no signal of widespread automated exploitation; however, a public technical write-up (hackmd.io/@leediay/idor-chatter-messager-aureus) describes the flaw, so publicly available exploit knowledge exists. The vulnerability class is trivially exploitable (sequential ID enumeration, low complexity, low privilege) and yields both read and write/delete access across tenant boundaries, which is high real-world impact for a multi-company ERP. The main mitigating factor is that PR:L requires a valid low-privileged account, and Aureus ERP's real-world deployment footprint is small. Signals are consistent overall; the only caveat is that A:N is correct (no availability impact beyond message deletion, which is captured under integrity) and the KEV/EPSS absence means priority should be driven by exposure of the specific instance rather than mass-exploitation risk.

An attacker with any low-privileged authenticated account in a multi-company/multi-department Aureus ERP instance opens the ChatterPanel and submits sequential message IDs belonging to records they do not own. Because message lookups were not scoped to the current record, they can read, edit, delete, or pin other departments' or companies' messages and enumerate every note in the system. A public write-up documenting the technique already exists, lowering the skill required.