Executive brief
IDURAR ERP CRM is an open-source accounting and invoicing platform. An authenticated administrator can reset the password of any other administrator account by manipulating the account identifier in a request, then log in as that account. This allows an attacker with admin privileges to take over other admin accounts without authorization, potentially leading to unauthorized access to sensitive business data and financial records.
Technical details
The vulnerability is an authorization bypass (broken access control) in the password update endpoint at backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js. The handler extracts the authenticated user from the request token but applies password updates based on req.params.id from the URL path, without validating that the authenticated user is updating their own account. The sole protection is a hardcoded rejection of a demo address. An attacker with any valid administrator session can therefore set an arbitrary password on any other administrator account. The endpoint is already protected by administrator token checks, so the attack requires an existing admin session but no further user interaction or privileges beyond that role.
Affected products
- IDURAR ERP CRM 4.1.0 and earlier
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-81031