CVE-2026-81031

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81031", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-26T15:23:06.348Z", "datePublished": "2026-08-26T15:44:59.362Z", "dateUpdated": "2026-08-29T02:43:32.712Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-28T15:18:33.487Z"}, "datePublic": "2026-08-26T00:00:00.000Z", "title": "IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update", "descriptions": [{"lang": "en", "value": "IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and never compares the two. The route is mounted behind the administrator token check only, so any valid administrator session is sufficient, and the sole ownership-like guard in the handler rejects a single hardcoded demo address. A caller can therefore set an arbitrary password on any other administrator account and sign in as it. The read handler in the same controller directory accepts an identifier the same way, which supplies the identifiers needed to pick a target."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "affected": [{"vendor": "idurar", "product": "idurar-erp-crm", "collectionURL": "https://github.com/idurar/idurar-erp-crm", "packageURL": "pkg:github/idurar/idurar-erp-crm", "repo": "https://github.com/idurar/idurar-erp-crm", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "4.1.1", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:idurarapp:idurar:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.1.1"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "references": [{"url": "https://github.com/idurar/idurar-erp-crm", "tags": ["product"]}, {"url": "https://github.com/idurar/idurar-erp-crm/issues/1470", "tags": ["issue-tracking"]}, {"url": "https://github.com/idurar/idurar-erp-crm/blob/4.1.0/backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/idurar-erp-crm-through-4.1.1-account-takeover-via-unverified-identifier-on-password-update"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/idurar/idurar-erp-crm/issues/1470", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-29T02:42:57.965270Z", "id": "CVE-2026-81031", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-29T02:43:32.712Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-81031", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-29T02:42:57.965270Z"}}}], "references": [{"url": "https://github.com/idurar/idurar-erp-crm/issues/1470", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-29T02:43:25.615Z"}}], "cna": {"title": "IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/idurar/idurar-erp-crm", "vendor": "idurar", "product": "idurar-erp-crm", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.1.1"}], "packageURL": "pkg:github/idurar/idurar-erp-crm", "collectionURL": "https://github.com/idurar/idurar-erp-crm", "defaultStatus": "unaffected"}], "datePublic": "2026-08-26T00:00:00.000Z", "references": [{"url": "https://github.com/idurar/idurar-erp-crm", "tags": ["product"]}, {"url": "https://github.com/idurar/idurar-erp-crm/issues/1470", "tags": ["issue-tracking"]}, {"url": "https://github.com/idurar/idurar-erp-crm/blob/4.1.0/backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/idurar-erp-crm-through-4.1.1-account-takeover-via-unverified-identifier-on-password-update", "name": "VulnCheck Advisory: IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and never compares the two. The route is mounted behind the administrator token check only, so any valid administrator session is sufficient, and the sole ownership-like guard in the handler rejects a single hardcoded demo address. A caller can therefore set an arbitrary password on any other administrator account and sign in as it. The read handler in the same controller directory accepts an identifier the same way, which supplies the identifiers needed to pick a target."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:idurarapp:idurar:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "4.1.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-28T15:18:33.487Z"}}}, "cveMetadata": {"cveId": "CVE-2026-81031", "state": "PUBLISHED", "dateUpdated": "2026-08-29T02:43:32.712Z", "dateReserved": "2026-08-26T15:23:06.348Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-26T15:44:59.362Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/idurar/idurar-erp-crm", "defaultStatus": "unaffected", "packageURL": "pkg:github/idurar/idurar-erp-crm", "product": "idurar-erp-crm", "repo": "https://github.com/idurar/idurar-erp-crm", "vendor": "idurar", "versions": [{"lessThanOrEqual": "4.1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and never compares the two. The route is mounted behind the administrator token check only, so any valid administrator session is sufficient, and the sole ownership-like guard in the handler rejects a single hardcoded demo address. A caller can therefore set an arbitrary password on any other administrator account and sign in as it. The read handler in the same controller directory accepts an identifier the same way, which supplies the identifiers needed to pick a target."}], "id": "CVE-2026-81031", "lastModified": "2026-09-24T20:43:32.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81031", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-29T02:42:57.965270Z", "version": "2.0.3"}}]}, "published": "2026-08-26T16:16:45.860", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/idurar/idurar-erp-crm"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/idurar/idurar-erp-crm/blob/4.1.0/backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/idurar/idurar-erp-crm/issues/1470"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/idurar-erp-crm-through-4.1.1-account-takeover-via-unverified-identifier-on-password-update"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/idurar/idurar-erp-crm/issues/1470"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.1.1]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 80.0, "source": "matching"}]}, "original": {"product": "idurar-erp-crm", "source": "cna", "vendor": "idurar"}, "product": "idurar_erp_crm", "vendor": "idurar"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "idurar", "vendor": "idurarapp"}], "created": "2026-08-26T18:00:04.296215+00:00", "updated": "2026-09-01T14:24:03.126800+00:00", "vendors": ["idurar", "idurar$PRODUCT$idurar_erp_crm", "idurarapp", "idurarapp$PRODUCT$idurar"]}