CVE-2026-72600: Idurar IDURAR ERP CRM - Broken Access Control

Published Aug 11, 2026

Updated

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.

Affected Software

1 affected component

Idurar IDURAR ERP CRM=4.1.0

Event History

Aug 11, 2026

CVE Published

via MITRE·11:14 AM

Data Sourced

via MITRE·11:14 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72600?

The severity of CVE-2026-72600 is rated high with a score of 7.5.

How do I fix CVE-2026-72600?

To fix CVE-2026-72600, implement authentication middleware for the /download router to restrict access.

What type of data is exposed in CVE-2026-72600?

CVE-2026-72600 allows unauthorized access to PDF files containing customer personally identifiable information (PII).

Who is affected by CVE-2026-72600?

Organizations using Idurar IDURAR ERP CRM version 4.1.0 are affected by CVE-2026-72600.

Can CVE-2026-72600 be exploited remotely?

Yes, CVE-2026-72600 can be exploited remotely by unauthenticated attackers.