CVE-2026-92752
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.
Fraqueza
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.
Referências
- https://github.com/metasfresh/metasfresh
- https://github.com/metasfresh/metasfresh/blob/c4c7766ef403eb470c9130031cf24cc33625ceed/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/attachments/DocumentAttachmentsRestController.java#L63-L225
- https://github.com/metasfresh/metasfresh/blob/c4c7766ef403eb470c9130031cf24cc33625ceed/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/upload/ImageRestController.java#L100-L107
- https://github.com/metasfresh/metasfresh/issues/24665
- https://www.vulncheck.com/advisories/metasfresh-unauthorized-access-via-document-attachments-and-comments-endpoints
- https://github.com/metasfresh/metasfresh/issues/24665
Encontre a falha antes de um atacante.
Entre com o GitHub e rode sua primeira auditoria em menos de um minuto. O plano gratuito não exige cartão de crédito.