Metasfresh
Monthly
Authenticated attackers holding any valid low-privilege role in metasfresh can read, replace, and delete attachments and comments belonging to records their role is not permitted to access. The DocumentAttachmentsRestController and CommentsRestController endpoints enforce only login state and never apply metasfresh's record-level (role/organization) permissions, so an attacker who enumerates sequential document identifiers can traverse records across access boundaries - an insecure direct object reference (CWE-639) rated 8.7 under CVSS 4.0 (CVSS 3.1 assessment: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Exploitation requires a valid account and sequentially enumerable identifiers; no public exploit code exists, and there is no confirmed actively exploited (CISA KEV) status at time of analysis.
Authenticated attackers holding any valid low-privilege role in metasfresh can read, replace, and delete attachments and comments belonging to records their role is not permitted to access. The DocumentAttachmentsRestController and CommentsRestController endpoints enforce only login state and never apply metasfresh's record-level (role/organization) permissions, so an attacker who enumerates sequential document identifiers can traverse records across access boundaries - an insecure direct object reference (CWE-639) rated 8.7 under CVSS 4.0 (CVSS 3.1 assessment: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Exploitation requires a valid account and sequentially enumerable identifiers; no public exploit code exists, and there is no confirmed actively exploited (CISA KEV) status at time of analysis.