CVE-2026-72600

HIGH 7.5

Idurar IDURAR ERP CRM - Broken Access Control

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.

CWE	CWE-284
Vendor	idurar
Product	idurar erp crm
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for idurar idurar erp crm

Be the first to know when new high vulnerabilities affecting idurar idurar erp crm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Idurar / IDURAR ERP CRM

0 ≤ 4.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/idurar/idurar-erp-crm

Credits

Bobur Abdugafforov