CVE-2026-111632: Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id

Q: Who can exploit this issue?

An attacker must be an authenticated API user with access to affected plugin REST API create or update endpoints. No user interaction is required, and the issue is reachable over the network.

Q: What does an attacker need to send to trigger the authorization bypass?

The attacker supplies a company_id belonging to a company they are not authorized to use in a create or update request. Affected endpoint types include plugin REST APIs for partners, sales, and inventories.

Q: What is the likely impact of successful exploitation?

An authenticated user can create records in, or move records into, disallowed companies. This breaks multi-company data segregation and can affect the confidentiality and integrity of data across company boundaries.

Q: Which versions are identified as affected?

Aureus ERP through version 1.6.0 is identified as affected.

Published Oct 16, 2026

Updated

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign companyid. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.

Affected Software

1 affected component

Aureus Aureus ERP<=1.6.0

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be an authenticated API user with access to affected plugin REST API create or update endpoints. No user interaction is required, and the issue is reachable over the network.

What does an attacker need to send to trigger the authorization bypass?

The attacker supplies a company_id belonging to a company they are not authorized to use in a create or update request. Affected endpoint types include plugin REST APIs for partners, sales, and inventories.

What is the likely impact of successful exploitation?

An authenticated user can create records in, or move records into, disallowed companies. This breaks multi-company data segregation and can affect the confidentiality and integrity of data across company boundaries.

Which versions are identified as affected?

Aureus ERP through version 1.6.0 is identified as affected.

CVE-2026-111632: Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send to trigger the authorization bypass?

What is the likely impact of successful exploitation?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send to trigger the authorization bypass?

What is the likely impact of successful exploitation?

Which versions are identified as affected?