CVE-2026-95655: Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
Published Sep 22, 2026
·Updated
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
Affected Software
1 affected component
Aureus ERP<1.5.0
Event History
Sep 22, 2026
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any authenticated Aureus ERP user can exploit it. The attacker needs only a valid account and can submit sequential message IDs; no user interaction is required.
2
What data and actions are exposed?
An attacker can enumerate notes across the system and access messages belonging to other departments or companies. They can read, edit, delete, or pin those messages.
3
Which deployments are affected?
Aureus ERP versions before 1.5.0 are affected. The issue is in the ChatterPanel message lookup behavior.