---
cve: "CVE-2026-95655"
severity: "HIGH"
cvss: 8.6
epss: "0.5%"
vendor: "Webkul"
kev: false
exploited: false
published: "2026-09-22 16:18:18"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-29T16:31:02+01:00"
---

# CVE-2026-95655

> 8.6 HIGH · 🧪 PoC

## Beschreibung

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-06 13:37:05
- CNA-CVSS: **8.6** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-639** — Authorization Bypass Through User-Controlled Key
  The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

## Patch verfügbar (OSV)

- 8409fde6250d2e3f91522aed0bd0defd18b7a5d8 (Commit)
- d3d5ac20ec544e97636490db6f86a391c04ce899 (Commit)

## Referenzen

- <https://github.com/aureuserp/aureuserp/commit/d3d5ac20ec544e97636490db6f86a391c04ce899>
- <https://github.com/aureuserp/aureuserp/pull/1382>
- <https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L503>
- <https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L685>
- <https://hackmd.io/@leediay/idor-chatter-messager-aureus>
- <https://github.com/aureuserp/aureuserp/releases/tag/v1.5.0>
- <https://github.com/aureuserp/aureuserp>
- <https://www.vulncheck.com/advisories/aureus-erp-before-1.5.0-unscoped-message-access-via-chatterpanel>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-95655/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_