CVE-2026-92752 metasfresh Unauthorized Access via Document Attachments and Comments Endpoints
Attackers can read, modify, or delete document attachments and comments on unauthorized records by exploiting missing record-level permission checks in metasfresh.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92752?
CVE-2026-92752 is a high-severity missing authorization vulnerability in metasfresh, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.
Weakness: CWE-639
Which versions are affected by CVE-2026-92752?
How do I fix CVE-2026-92752?
No fix has been published for CVE-2026-92752 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-92752 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92752 exists.
Sources
Also known as GHSA-9hmf-cxg8-mqx6.