Executive brief
metasfresh is an open-source ERP (enterprise resource planning) system that manages business documents, attachments, and comments. The vulnerability allows authenticated users to access, modify, and delete attachments and comments on documents they should not have permission to view—potentially exposing sensitive business records, financial data, or confidential communications.
Technical details
The DocumentAttachmentsRestController and CommentsRestController endpoints enforce only authentication (checking that a user is logged in) but do not validate record-level authorization before allowing read, update, or delete operations on attachments and comments. An attacker with valid credentials can enumerate sequential document identifiers and leverage the missing authorization checks to access restricted records. The vulnerability is exploitable over the network by any authenticated user, without requiring elevated privileges or user interaction. No patch information is publicly available at the advisory publication date.
Affected products
- metasfresh metasfresh
Timeline
- 2026-09-16: disclosed