Aureus ERP EUVD-2026-99259

Exploitation requires that the Aureus ERP blogs/Website plugin is deployed with a public customer-facing blog and that at least one unpublished/draft post exists; the attacker must know or guess that draft post's slug, which is the key limiting factor (reflected as AT:P in the vendor vector) since draft slugs are not publicly linked. No authentication is required (PR:N) and no user interaction is needed, and the flaw is present in default behavior of the customer post view page because PostResource omits the authorization check and ViewPost does not enforce is_published. Impact is strictly limited to read-only disclosure of draft blog post fields (title, content, image, tags, author, publish date) - no write access or system compromise.

This is a medium-severity information-disclosure issue, not a high-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.3 and correctly caps impact at confidentiality-Low with no integrity or availability effect - the only thing leaked is the content of unpublished draft blog posts (title, body, image, tags, author, publish date), not credentials, PII, or system data. The AT:P (attack-requirements present) metric reflects that the attacker must know or guess a valid draft-post slug, which meaningfully limits trivial mass exploitation. No EPSS score and no KEV status were supplied in the input, and there is no explicit POC flag, so exploitation-probability signals are absent rather than low - this gap should be noted, not read as 'safe.' A public technical write-up (hackmd) and a VulnCheck advisory exist and would materially lower the bar for a motivated attacker, but that is write-up availability, not confirmed weaponization. Bottom line: real but modest risk, driven entirely by whether draft posts contain sensitive or embargoed content; for most deployments this is a low-to-moderate remediation priority.

An unauthenticated attacker visits the customer-facing blog post view page and supplies the slug of a post that has not yet been published. Because PostResource skips the authorization check and ViewPost ignores the is_published flag, the server returns the full draft content. A public technical write-up describing the flaw exists, but the input contains no confirmed exploit code or active-exploitation signal.