Threats affecting pkg:github/aureuserp/aureuserp

Aureus ERP versions up to 1.6.0 have an authorization bypass vulnerability that permits authenticated API users to create or move records into companies they should not have access to by supplying a foreign company_id. This flaw affects multi-company data segregation by allowing unauthorized data manipulation through plugin REST API endpoints such as partners, sales, or inventories.

A vulnerability in Webkul Aureus ERP versions up to 1.6.0 allows authenticated users to upload malicious SVG files containing JavaScript. These files are stored on a public disk and served from the application origin, enabling script execution when the SVG file URL is accessed. This can lead to session cookie theft and CSRF token exfiltration. The issue is fixed in a commit identified as 53ad76d.

CVE-2026-95655 is a high-severity authorization bypass vulnerability in Webkul Aureus ERP versions before 1.5.0. The flaw allows authenticated users to access, modify, or delete arbitrary messages across departments or companies by exploiting improper scoping of message lookups in the ChatterPanel. Attackers can enumerate all notes in the system by submitting sequential message IDs.

CVE-2026-94387 is a stored cross-site scripting (XSS) vulnerability in Webkul Aureus ERP versions before 1.6.0. The flaw exists in the Chatter field-change log where old_value and new_value entries are not properly escaped. This allows users with permission to edit tracked text fields to inject malicious markup that executes when other users view the Chatter panel, including administrators.

A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component.