# CVE-2026-57869: MicroRealEstate broken access control in Documents API

Source: https://junglewise.ai/threats/cve-2026-57869-microrealestate-broken-access-control-in-documents-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-57869 · Severity: info · CVSS 7.1 · Published 2026-07-07

MicroRealEstate, an open-source property management platform, contains a security flaw that allows unauthorized access to sensitive documents. Because the system uses predictable patterns to generate identification numbers, an attacker can guess these IDs to view or download private files uploaded by landlords and tenants. This could lead to the exposure of rental agreements, personal identification, and other confidential records.

## Quick answers

**Is CVE-2026-57869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57869 being exploited in the wild.

**How severe is CVE-2026-57869?** Informational severity, with a CVSS score of 7.1, published 7 July 2026.

**Which products and versions are affected?** MicroRealEstate MicroRealEstate through 1.0.0-alpha3.

**Is there a fix for CVE-2026-57869?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57869 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57869?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

MicroRealEstate is vulnerable to an Insecure Direct Object Reference (IDOR) flaw combined with weak entropy in identifier generation. The application uses a deterministic pattern to generate 'random' identifiers for organizations, significantly reducing the search space for these IDs. An authenticated attacker can exploit this predictability to brute-force organization IDs and bypass broken object-level access controls (BOLA) within the Documents API. Successful exploitation allows the retrieval of arbitrary documents uploaded by any landlord or tenant on the platform. The vulnerability affects all versions through 1.0.0-alpha3.

## Affected products

- MicroRealEstate MicroRealEstate through 1.0.0-alpha3

## Timeline

- 2026-07-07: advisory: Advisory published by The Missing Link Australia
- 2026-07-07: disclosed: CVE-2026-57869 published to NVD

## References

- [https://github.com/microrealestate/microrealestate](https://github.com/microrealestate/microrealestate)
- [https://www.themissinglink.com.au/security-advisories/cve-2026-57869](https://www.themissinglink.com.au/security-advisories/cve-2026-57869)