CVE-2026-95655: Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-22 · updated 2026-09-28
Weakness: CWE-639

Description

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

Affected products

Webkul Aureus ERP: before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: Webkul Aureus ERP 1.5.0. Check the vendor advisory for mitigations.

References

https://github.com/aureuserp/aureuserp
https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L503
https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L685
https://github.com/aureuserp/aureuserp/commit/d3d5ac20ec544e97636490db6f86a391c04ce899
https://github.com/aureuserp/aureuserp/pull/1382
https://github.com/aureuserp/aureuserp/releases/tag/v1.5.0
https://hackmd.io/@leediay/idor-chatter-messager-aureus
https://www.vulncheck.com/advisories/aureus-erp-before-1.5.0-unscoped-message-access-via-chatterpanel

Get alerted when CVE-2026-95655 or the next vulnerability affects your stack