Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into… (CVE-2026-111632)

CVE-2026-111632 describes an authorization bypass vulnerability in Aureus ERP through version 1.6.0. Authenticated API users can exploit this vulnerability by submitting create or update requests with a foreign company_id parameter to plugin REST API endpoints, including partners, sales, or inventories. This allows them to create or move records into companies they are not authorized to access, breaking the intended multi-company data segregation controls.

The vulnerability allows authenticated users to bypass authorization controls and manipulate data across company boundaries within the ERP system. This can lead to unauthorized data access and modification, potentially compromising data integrity and confidentiality within multi-company deployments. The CVSS score of 5.4 (medium severity) reflects limited confidentiality and integrity impact without availability impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API user permissions carefully and monitor API usage for suspicious activity related to company_id manipulation.