What’s Vulnerable › Vulnerabilities

CVE-2026-111632: Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-16 · updated 2026-10-16
• Weakness: CWE-639

Description

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.

Affected products

• aureuserp: through 1.6.0

References

• https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/partners/src/Http/Requests/PartnerRequest.php#L52
• https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/support/src/Traits/BelongsToCompany.php#L10-L19
• https://github.com/aureuserp/aureuserp/commit/5dab06a958d1e7546cf9f2ebf48f9843909ed972
• https://hackmd.io/@leediay/HygpHMknGl
• https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-multi-company-authorization-bypass-via-company-id
• https://hackmd.io/@leediay/HygpHMknGl

Get alerted when CVE-2026-111632 or the next vulnerability affects your stack