CVE-2026-92752: metasfresh Unauthorized Access via Document Attachments and Comments Endpoints
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated metasfresh user may be able to exploit it. The affected endpoints require a logged-in session but do not enforce whether that user is authorized to access the targeted record.
What does an attacker need to do to access another record's data?
The attacker needs to enumerate sequential document identifiers and submit requests to the document attachment or comment endpoints. No user interaction is required.
What actions are possible through the affected endpoints?
An authenticated attacker can read, replace, or delete attachments and comments associated with records that their assigned role should not be able to access.