# CVE-2026-57870: MicroRealEstate broken access control in Templates API

Source: https://junglewise.ai/threats/cve-2026-57870-microrealestate-broken-access-control-in-templates-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-57870 · Severity: info · CVSS 5.3 · Published 2026-07-07

MicroRealEstate, an open-source platform for managing rental properties and real estate, contains a security flaw in how it handles document templates. An authorized user from one organization can access and download document templates belonging to other organizations on the same platform. This could lead to the exposure of proprietary business documents, lease structures, or sensitive organizational templates to unauthorized parties.

Technologies: [Camel Aissani MicroRealEstate](https://junglewise.ai/threats/technologies/microrealestate). Vendors: [Camel Aissani](https://junglewise.ai/threats/vendors/camel-aissani).

## Quick answers

**Is CVE-2026-57870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57870 being exploited in the wild.

**How severe is CVE-2026-57870?** Informational severity, with a CVSS score of 5.3, published 7 July 2026.

**Which products and versions are affected?** Camel Aissani MicroRealEstate through 1.0.0-alpha3.

**Is there a fix for CVE-2026-57870?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57870 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57870?** Check whether you run Camel Aissani MicroRealEstate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Broken Object Level Authorization (BOLA) vulnerability exists in the Templates API of MicroRealEstate through version 1.0.0-alpha3. The application fails to validate whether the requesting user has the appropriate permissions or organizational affiliation to access a specific template resource. By manipulating template identifiers in API requests, an authenticated attacker can bypass intended isolation boundaries to retrieve document templates belonging to any other organization registered on the platform. As of the advisory date, no official patch has been confirmed.

## Affected products

- Camel Aissani MicroRealEstate through 1.0.0-alpha3

## Timeline

- 2026-07-07: disclosed: Vulnerability disclosed by The Missing Link Security
- 2026-07-07: advisory

## References

- [https://github.com/microrealestate/microrealestate](https://github.com/microrealestate/microrealestate)
- [https://www.themissinglink.com.au/security-advisories/cve-2026-57870](https://www.themissinglink.com.au/security-advisories/cve-2026-57870)

## Related threats

- [MicroRealEstate authentication bypass via OTP brute-force](https://junglewise.ai/threats/cve-2026-57867-microrealestate-authentication-bypass-via-otp-brute-force)