Aureus ERP versions prior to 1.5.0 do not properly restrict message lookups in the ChatterPanel to the current record context. This lack of scoping permits authenticated users to bypass authorization controls by submitting sequential message IDs, thereby accessing arbitrary messages belonging to other departments or companies. The vulnerability allows unauthorized reading, editing, deletion, and pinning of messages, and facilitates enumeration of all notes within the system.

Authenticated users can bypass authorization controls to access and manipulate messages outside their authorized scope. This includes reading sensitive messages, modifying or deleting them, pinning messages arbitrarily, and enumerating all notes in the ERP system. Such unauthorized access can lead to data leakage, integrity violations, and potential disruption of business communications across departments or companies using the ERP.

A fix is available in Aureus ERP version 1.5.0. Users should upgrade to version 1.5.0 or later to remediate this vulnerability. No vendor advisory content was provided, but the affected versions and fix version are clearly stated. Until upgrading, restrict access to authenticated users and monitor for suspicious activity related to message access if possible.