CVE-2026-81031: Authorization Bypass Through User-Controlled Key in idurar idurar-erp-crm

The vulnerability exists in the password update handler of idurar-erp-crm, where the authenticated user is resolved from the token middleware, but the password update is applied based on an identifier supplied in the URL path without verifying that the authenticated user matches this identifier. The route is protected only by an administrator token check, and the only ownership guard rejects a single hardcoded demo address. This flaw allows an attacker with any valid administrator session to set arbitrary passwords on other administrator accounts and subsequently sign in as those accounts. The read handler similarly accepts an identifier to select a target, facilitating exploitation.

An attacker with any valid administrator session can change the password of any other administrator account, leading to full account takeover of those accounts. This compromises the integrity and confidentiality of administrator accounts and potentially the entire system managed by idurar-erp-crm.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator session access to trusted users only and monitor for suspicious password changes. Implement additional verification in the password update handler to ensure the authenticated user matches the account being updated.