Missing Record-Level Authorization in metasfresh Affected by Low-Privilege User Access
CVE-2026-111351

2.3LOW

Key Information:

Vendor

Metasfresh

Status
Metasfresh
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111351?

The metasfresh application prior to version 5.176 contains a critical vulnerability within the BoardRestController, which allows low-privilege authenticated users to bypass essential role-based and organization access controls. This flaw can be exploited through various handlers, such as getBoard, getCard, addCard, removeCard, and patchCard, granting unauthorized access to sensitive records or enabling modifications to board card assignments that are beyond the user's designated scope.

Affected Version(s)

metasfresh 0 <= 5.175

References

https://hackmd.io/@hieuPenguinnn/metasfresh-board-rest-mi...
third-party-advisory
https://github.com/metasfresh/metasfresh/blob/5.175/backe...
technical-description
https://github.com/metasfresh/metasfresh/blob/56dd881b972...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.