CVE-2026-111632

MEDIUM 5.4

Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.

CWE	CWE-639
Vendor	aureuserp
Product	aureuserp
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for aureuserp aureuserp

Be the first to know when new medium vulnerabilities affecting aureuserp aureuserp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

aureuserp / aureuserp

0 ≤ 1.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@leediay/HygpHMknGl github.com: https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/partners/src/Http/Requests/PartnerRequest.php#L52 github.com: https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/support/src/Traits/BelongsToCompany.php#L10-L19 github.com: https://github.com/aureuserp/aureuserp/commit/5dab06a958d1e7546cf9f2ebf48f9843909ed972 vulncheck.com: https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-multi-company-authorization-bypass-via-company-id

Credits

leediay153 from Viettel Post