CVE-2026-72600 Idurar IDURAR ERP CRM - Broken Access Control
Unauthenticated attackers can download invoice PDFs containing customer PII by accessing an unprotected router endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72600?
CVE-2026-72600 is a high-severity missing authorization vulnerability in IDURAR ERP CRM, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.
Weakness: CWE-284
Which versions are affected by CVE-2026-72600?
How do I fix CVE-2026-72600?
No fix has been published for CVE-2026-72600 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72600 being exploited?
There is no known exploitation of CVE-2026-72600 in the wild and no public exploit code.
Sources
Also known as GHSA-93xg-c6hj-rp82.