Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-111351

metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Metasfresh
Products
Metasfresh
CVE-2026-92752

metasfresh Unauthorized Access via Document Attachments and Comments Endpoints

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Metasfresh
Products
Metasfresh