Executive brief
MicroRealEstate, an open-source property management platform, contains a security flaw that allows unauthorized access to sensitive documents. Because the system uses predictable patterns to generate identification numbers, an attacker can guess these IDs to view or download private files uploaded by landlords and tenants. This could lead to the exposure of rental agreements, personal identification, and other confidential records.
Technical details
MicroRealEstate is vulnerable to an Insecure Direct Object Reference (IDOR) flaw combined with weak entropy in identifier generation. The application uses a deterministic pattern to generate 'random' identifiers for organizations, significantly reducing the search space for these IDs. An authenticated attacker can exploit this predictability to brute-force organization IDs and bypass broken object-level access controls (BOLA) within the Documents API. Successful exploitation allows the retrieval of arbitrary documents uploaded by any landlord or tenant on the platform. The vulnerability affects all versions through 1.0.0-alpha3.
Affected products
- MicroRealEstate MicroRealEstate through 1.0.0-alpha3
Timeline
- 2026-07-07: advisory: Advisory published by The Missing Link Australia
- 2026-07-07: disclosed: CVE-2026-57869 published to NVD