Missing authorization in Aureus ERP exposes unpublished blog posts
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Aureus ERP through 1.6.0 lets unauthenticated attackers read unpublished draft blog posts through the customer-facing post view page. The flaw is a missing authorization check (CWE-862) in PostResource, and ViewPost ignores the is_published flag. An attacker who knows or guesses a post slug can retrieve the post title, content, image, tags, author and publish date.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Aureus ERP.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-13 Threatist record created from CVE-2026-110218
- 2026-10-13 Alias added: GHSA-mj62-84wx-6gp9
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-15 CISA SSVC decision points changed
References
Advisory 1
Other 4
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/blogs/src/Filament/Customer/Resources/PostResource/Pages/ViewPost.php#L9-L24
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/blogs/src/Filament/Customer/Resources/PostResource.php#L23
- aureuserp v1.6.0 Release Notes
- https://github.com/aureuserp/aureuserp
More Webkul vulnerabilities
- TI-2025-41192 Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and… CVSS 3.1CRITICAL 9.8
- TI-2017-14326 Joomla! Component Ajax Quiz 1.8 SQL Injection CVSS 4.0HIGH 8.8
- TI-2026-17332 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product CVSS 4.0HIGH 8.9
- TI-2023-16589 Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). CVSS 3.1HIGH 8.8
- TI-2026-56886 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint CVSS 4.0HIGH 8.6
- TI-2026-52873 Webkul QloApps SQL injection CVSS 4.0HIGH 8.6
Sources
- CVE-2026-110218 · CVE Program
- CVE-2026-110218 · NVD
- FIRST EPSS
- GHSA-mj62-84wx-6gp9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences