Is CVE-2026-112190 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112190 being exploited in the wild.

How severe is CVE-2026-112190?

Medium severity, with a CVSS score of 5.3, published 19 October 2026.

Is there a fix for CVE-2026-112190?

No fixed version is recorded yet. Set APP_DEBUG=false in the .env configuration before deploying to production. Move barryvdh/laravel-debugbar from the require section to require-dev in composer.json to prevent it from being loaded outside of local development environments. [{"kind":"disclosed","at":"2026-09-02","note":"Vulnerability reported to vendor"},{"kind":"other","at":"2026-10-19","note":"CVE-2026-112190 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-112190 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112190?

Check whether you run Webkul Aureus ERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112190: Webkul Aureus ERP information disclosure via debug mode

CVE-2026-112190 · Severity: medium · CVSS 5.3 · Published 2026-10-19

Aureus ERP, an enterprise resource planning system, ships with debug mode enabled by default and includes a debugging toolbar as a production dependency. This exposes sensitive information including internal file paths, database queries with session IDs, server versions, and request history to any user accessing the application without authentication.

Vendors: Webkul.

Quick answers

Is CVE-2026-112190 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112190 being exploited in the wild.
How severe is CVE-2026-112190?: Medium severity, with a CVSS score of 5.3, published 19 October 2026.
Which products and versions are affected?: Webkul Aureus ERP up to 1.6.0.
Is there a fix for CVE-2026-112190?: No fixed version is recorded yet. Set APP_DEBUG=false in the .env configuration before deploying to production. Move barryvdh/laravel-debugbar from the require section to require-dev in composer.json to prevent it from being loaded outside of local development environments.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-02","note":"Vulnerability reported to vendor"},{"kind":"other","at":"2026-10-19","note":"CVE-2026-112190 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112190 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112190?: Check whether you run Webkul Aureus ERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Set APP_DEBUG=false in the .env configuration before deploying to production. Move barryvdh/laravel-debugbar from the require section to require-dev in composer.json to prevent it from being loaded outside of local development environments.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-02","note":"Vulnerability reported to vendor"},{"kind":"other","at":"2026-10-19","note":"CVE-2026-112190 published"}]

Technical details

The vulnerability is an information exposure via insecure default configuration (CWE-215). The application enables APP_DEBUG=true by default and bundles barryvdh/laravel-debugbar in production dependencies, causing the debug toolbar to render on every page. An unauthenticated network attacker can view internal implementation details, raw SQL queries, session identifiers, and application routes without authentication or user interaction.

Affected products

Webkul Aureus ERP up to 1.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.