Authorization Bypass in Aureus ERP Affects Unpublished Blog Content

CVE-2026-110218

What is CVE-2026-110218?

Aureus ERP version 1.6.0 is susceptible to an authorization bypass vulnerability that enables unauthenticated attackers to access unpublished draft blog posts. This flaw arises from a failure in the PostResource component to enforce authorization checks, allowing attackers to exploit knowledge or guesswork concerning a post slug. They can retrieve sensitive information such as the full title, content, images, tags, author details, and publication dates directly through the customer-facing post view page.

References