Description

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-22T16:18:18.943Z",
  "pubdate": "2026-09-22T16:18:18.943Z",
  "executiveSummary": "Aureus ERP versions prior to 1.5.0 contain a critical Insecure Direct Object Reference (IDOR) vulnerability within the ChatterPanel component. This flaw stems from improper input validation and a failure to enforce authorization checks during message lookup operations. Consequently, the application fails to restrict access to messages based on the current record context or the authenticated user's assigned organizational scope.\nThe vulnerability allows an authenticated attacker to perform unauthorized CRUD (Create, Read, Update, Delete) operations on sensitive communication data, including messages belonging to disparate departments or distinct business entities within the ERP ecosystem. By manipulating sequential message identifiers, a malicious actor can systematically bypass data segregation boundaries, leading to full unauthorized disclosure and modification of inter-organizational notes. This represents a significant risk to data confidentiality and integrity, particularly in multi-tenant environments where departmental isolation is mandatory. Successful exploitation requires an authenticated session but leverages the lack of server-side object-level access control to facilitate unauthorized system-wide enumeration and manipulation of sensitive communications.",
  "technicalDetails": "The root cause of this vulnerability lies in the server-side implementation of the ChatterPanel message retrieval logic, which fails to associate requested message IDs with the session-based authorization context of the authenticated user. In versions of Aureus ERP prior to 1.5.0, the backend infrastructure executes lookup queries based solely on the provided message ID parameter, omitting necessary checks to verify if the requesting user possesses the required permissions or logical association to the target record.\nExploitation is conducted through a classic IDOR pattern. The attacker intercepts a valid communication request handled by the ChatterPanel component. By identifying the message ID parameter in the request payload, the attacker can systematically iterate through integer sequences—incrementing or decrementing the ID—to probe for messages outside their authorized scope. Since the application fails to validate the ownership or departmental affiliation of the requested resource against the user's session object, the backend returns the contents of arbitrary messages, regardless of their origin.\nThe attack flow follows these stages: 1) Authentication: The attacker establishes a valid session within the Aureus ERP environment. 2) Reconnaissance: Using standard proxy tools, the attacker captures legitimate ChatterPanel message retrieval requests to determine the request structure. 3) Enumeration: The attacker automates the modification of the message ID parameter. Because the application logic does not restrict the ID scope to the current record context, the server processes requests for messages belonging to other companies or departments. 4) Exploitation: Once an ID is identified, the attacker leverages the same authorization deficiency to issue unauthorized commands, including updating, deleting, or pinning the target messages. This effectively grants the attacker administrative-level control over the messaging data stored within the ERP, allowing for the exfiltration of sensitive internal communications and the disruption of collaborative workflows. The lack of granular, object-level access control at the controller level makes this an critical flaw for any enterprise relying on Aureus ERP for secure, multi-departmental document and message management."
}