Unauthorized Access Vulnerability in metasfresh Product by Metasfresh

CVE-2026-92752

What is CVE-2026-92752?

The metasfresh application contains a vulnerability in its DocumentAttachmentsRestController and CommentsRestController endpoints. These endpoints fail to enforce record-level permissions effectively, allowing authenticated attackers to enumerate document identifiers. Consequently, they can read, modify, or delete attachments and comments associated with records that their user roles should not be able to access. This security oversight poses a significant risk as it could lead to unauthorized disclosure or tampering of sensitive information.

References