Executive brief
Erxes is an open-source customer experience platform with a GraphQL API. An attacker can bypass authentication by providing a forged HTTP header to impersonate any user, gaining unauthorized access to customer data, communications, and system operations without valid credentials.
Technical details
Erxes versions prior to 1.6.1 contain an authentication bypass vulnerability in the GraphQL API layer. The vulnerability exists in the user authentication middleware (userMiddleware.ts), which accepts a "User" HTTP header at face value without validating its authenticity, allowing an attacker to specify any user ID to impersonate. The attack requires only network access to a reachable GraphQL endpoint (no prior authentication or user interaction needed). An attacker can exploit this to read sensitive customer data, modify configurations, or perform actions as any user in the system. The vulnerability is fixed in version 1.6.1 via commit 4ed2ca7.
Affected products
- Erxes Erxes < 1.6.1
Timeline
- 2025-06-10: disclosed
- 2025-06-10: patched: Fixed in version 1.6.1