CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update
An authenticated administrator can take over any other administrator account by specifying a different user identifier in the password update request.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81031?
CVE-2026-81031 is a high-severity authentication bypass vulnerability in idurar-erp-crm, published on 26 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and never compares the two. The route is mounted behind the administrator token check only, so any valid administrator session is sufficient, and the sole ownership-like guard in the handler rejects a single hardcoded demo address. A caller can therefore set an arbitrary password on any other administrator account and sign in as it. The read handler in the same controller directory accepts an identifier the same way, which supplies the identifiers needed to pick a target.
Weakness: CWE-639
Which versions are affected by CVE-2026-81031?
How do I fix CVE-2026-81031?
No fix has been published for CVE-2026-81031 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-81031 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81031 exists.
Sources
Also known as GHSA-xj6j-6jhq-42gg.