TI-2026-69097 Aliases CVE-2026-107102 GHSA-c484-2gh9-jpr5

Account takeover in Manacle Technologies ERP System

MEDIUM 48CWE-345Published 2026-10-07 · Updated 2026-10-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

The Manacle Technologies Multi-tenant ERP System does not properly validate payment callback parameters in an API endpoint. Insufficient verification of data authenticity (CWE-345) and inadequate authentication controls let the application create an authenticated session for an arbitrary user without valid payment verification. An unauthenticated remote attacker can manipulate a parameter to gain unauthorized access to other user accounts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00255 17th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Manacle Technologies	Multi-tenant ERP System	version	—	No fix listed	CNA

Multi-tenant ERP System VendorManacle Technologies Affected version Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Multi-tenant ERP System.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-07 Threatist record created from CVE-2026-107102
2026-10-07 Alias added: GHSA-c484-2gh9-jpr5
2026-10-07 CISA SSVC decision points changed

References

Advisory 1

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430

TI-2026-57868 Remote Code Execution Vulnerability in Manacle Technologies ERP System CVSS 4.0CRITICAL 10.0
TI-2026-69099 Unsafe Deserialization in Manacle Technologies ERP System CVSS 4.0CRITICAL 9.3
TI-2026-69098 SQL injection in Manacle Technologies ERP System CVSS 4.0CRITICAL 9.3
TI-2026-57869 Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System CVSS 4.0CRITICAL 9.2
TI-2026-57870 Information Disclosure Vulnerability in Manacle Technologies ERP System CVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences