Openconstructionerp
Monthly
OpenConstructionERP through 14.8.1 can leak one user's data to another user's session through the AI Provider Configuration Handler implemented in backend/app/modules/ai/ai_client.py. The issue is only reachable by an account that is already authenticated on the instance (CVSS vector PR:L) and impact is limited to confidentiality and integrity of AI provider configuration data rather than full system compromise; the independent assessment rates the overall risk as low-to-moderate rather than a priority issue. Publicly available exploit code exists and the CVSS 4.0 vector carries an E:P (proof-of-concept) exploit-maturity score, so the flaw should still be treated as practically exploitable, but there is no confirmed actively exploited (CISA KEV) status for this CVE.
OpenConstructionERP through 14.8.1 can leak one user's data to another user's session through the AI Provider Configuration Handler implemented in backend/app/modules/ai/ai_client.py. The issue is only reachable by an account that is already authenticated on the instance (CVSS vector PR:L) and impact is limited to confidentiality and integrity of AI provider configuration data rather than full system compromise; the independent assessment rates the overall risk as low-to-moderate rather than a priority issue. Publicly available exploit code exists and the CVSS 4.0 vector carries an E:P (proof-of-concept) exploit-maturity score, so the flaw should still be treated as practically exploitable, but there is no confirmed actively exploited (CISA KEV) status for this CVE.