Vendor
Aureus ERP versions prior to 1.5.0 contain an authorization bypass in the ChatterPanel component, allowing authenticated users to access and manipulate arbitrary messages via ID enumeration.