# CVE-2026-81031: IDURAR ERP CRM privilege escalation via password reset

Source: https://junglewise.ai/threats/cve-2026-81031-idurar-erp-crm-privilege-escalation-via-password-reset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81031 · Severity: high · CVSS 7.2 · Published 2026-08-26

IDURAR ERP CRM is an open-source accounting and invoicing platform. An authenticated administrator can reset the password of any other administrator account by manipulating the account identifier in a request, then log in as that account. This allows an attacker with admin privileges to take over other admin accounts without authorization, potentially leading to unauthorized access to sensitive business data and financial records.

## Quick answers

**Is CVE-2026-81031 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81031 being exploited in the wild.

**How severe is CVE-2026-81031?** High severity, with a CVSS score of 7.2, published 26 August 2026.

**Which products and versions are affected?** IDURAR ERP CRM 4.1.0 and earlier.

**Is there a fix for CVE-2026-81031?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81031 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81031?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (broken access control) in the password update endpoint at backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js. The handler extracts the authenticated user from the request token but applies password updates based on req.params.id from the URL path, without validating that the authenticated user is updating their own account. The sole protection is a hardcoded rejection of a demo address. An attacker with any valid administrator session can therefore set an arbitrary password on any other administrator account. The endpoint is already protected by administrator token checks, so the attack requires an existing admin session but no further user interaction or privileges beyond that role.

## Affected products

- IDURAR ERP CRM 4.1.0 and earlier

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-81031

## References

- [https://github.com/idurar/idurar-erp-crm](https://github.com/idurar/idurar-erp-crm)
- [https://github.com/idurar/idurar-erp-crm/blob/4.1.0/backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js](https://github.com/idurar/idurar-erp-crm/blob/4.1.0/backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js)