Authorization Bypass in Aureus ERP ChatterPanel

Aureus ERP versions prior to 1.5.0 are vulnerable to an authorization bypass flaw within the ChatterPanel component. The application fails to properly scope message lookups to the current user's session or record, allowing any authenticated user to interact with arbitrary messages across the entire organization. By submitting sequential message IDs to the affected API endpoints, an attacker can read, edit, delete, or pin messages belonging to other departments or entities. This vulnerability poses a significant risk to organizational confidentiality and integrity, as it facilitates the mass enumeration of internal notes and unauthorized modification of business communication records. Defenders should prioritize patching affected instances to version 1.5.0 or later to mitigate this risk.

Impact

Successful exploitation allows an authenticated attacker to compromise internal communications. Potential consequences include the unauthorized exfiltration of sensitive organizational data, manipulation of business records, and the ability to pin or delete critical messages. Given the vulnerability allows for enumeration of all notes in the system, the scope of the impact can span the entire organization, potentially affecting all departments.

Recommendation

• Upgrade Aureus ERP to version 1.5.0 or later immediately to resolve the authorization logic flaw in the ChatterPanel component (CVE-2026-95655).
• Review web server access logs for anomalous patterns of sequential ID requests directed at API endpoints associated with the ChatterPanel module.
• Implement strict server-side authorization checks on all record-retrieval functions to ensure that users are scoped only to data they are explicitly permitted to access.