Login Request a demo
High severity · published Sep 22, 2026
CVE-2026-95655
Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Aureus ERP · Webkul
before 1.5.0 · source: vendor
Affected product
AE
Aureus ERP
Webkul
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-95655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-95655
patch
https://github.com/aureuserp/aureuserp/commit/d3d5ac20ec544e97636490db6f86a391c04ce899
patch
https://github.com/aureuserp/aureuserp/pull/1382
technical-description
https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L503
technical-description
https://github.com/aureuserp/aureuserp/blob/v1.4.0/plugins/webkul/chatter/src/Livewire/ChatterPanel.php#L685
third-party-advisory
https://hackmd.io/@leediay/idor-chatter-messager-aureus
release-notes
https://github.com/aureuserp/aureuserp/releases/tag/v1.5.0
More from Aureus ERP
5.4
CVE-2026-111284
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
5.4
CVE-2026-97062
Aureus ERP 1.6.0 Stored XSS via SVG File Upload
5.4
CVE-2026-94387
Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
5.4
CVE-2026-93454
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
5.3
CVE-2026-112190
Webkul Aureus ERP composer.json insertion of sensitive information into debugging code