Authorization bypass in metasfresh board REST API exposes records
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
metasfresh through 5.175 contains a missing record-level authorization check in BoardRestController, tracked as CWE-639. An authenticated user with low privileges can bypass role and organization access checks to read records outside their scope and change board card assignments.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| metasfresh | metasfresh | up to 5.175 | — | No fix listed | CNA |
- metasfresh Vendormetasfresh Affected up to 5.175 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for metasfresh.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111351
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: LOW → MEDIUM
References
Other 3
- https://github.com/metasfresh/metasfresh/blob/5.175/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardRestController.java#L137-L220
- https://github.com/metasfresh/metasfresh/blob/56dd881b972af4edb071e4f1261a55a8b1a9c4d7/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardDescriptorRepository.java#L473-L511
- https://github.com/metasfresh/metasfresh
More metasfresh vulnerabilities
- TI-2026-62498 metasfresh Unauthorized Access via Document Attachments and Comments Endpoints CVSS 4.0HIGH 8.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences