CVE-2026-72600 — Idurar IDURAR ERP CRM - Broken Access Control

CVE-2026-72600

Idurar IDURAR ERP CRM - Broken Access Control PUBLISHED

Description (CNA)

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.

Affected (CNA)

Vendor / product	Versions
Idurar / IDURAR ERP CRM	affected 0 through 4.1.0

CWE

CWE-284

References

https://github.com/idurar/idurar-erp-crm

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.