CVE-2026-111351: metasfresh Authorization Bypass Vulnerability

CVE-2026-111351 Overview

CVE-2026-111351 is a missing record-level authorization vulnerability in metasfresh through version 5.175. The flaw resides in the BoardRestController component of the open-source ERP platform. Authenticated low-privilege users can bypass role and organization access checks by invoking the getBoard, getCard, addCard, removeCard, and patchCard handlers directly. Successful exploitation allows attackers to read records outside their assigned scope and to modify board card assignments. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated low-privilege users can read and modify board data belonging to other roles or organizations, breaking tenant isolation within metasfresh ERP deployments.

Affected Products

• metasfresh ERP versions through 5.175
• Specifically the de.metas.ui.web.base backend module
• The BoardRestController REST API endpoints

Discovery Timeline

• 2026-10-15 - CVE-2026-111351 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111351

Vulnerability Analysis

The vulnerability affects the metasfresh REST API responsible for managing visual boards and card assignments. The BoardRestController class exposes handler methods between lines 137 and 220 of its source file. These handlers accept board and card identifiers from authenticated callers without validating that the caller's role or organization has access to the referenced records.

Attackers with valid but limited credentials can enumerate or guess board and card IDs. By calling the vulnerable endpoints with those IDs, they retrieve data belonging to other users and tenants. The patchCard, addCard, and removeCard operations also permit unauthorized modification of card placement on boards.

Root Cause

The underlying issue is a missing authorization check at the record level. The BoardDescriptorRepository logic between lines 473 and 511 resolves board descriptors and card data without re-validating the caller's permission against the specific record. The controller trusts that session-level authentication is sufficient, which conflicts with the multi-tenant and role-based model of metasfresh. This pattern aligns with CWE-639, where authorization decisions rely on user-controlled identifiers.

Attack Vector

Exploitation requires network access to the metasfresh REST API and a valid low-privilege account. The attacker crafts HTTP requests to the board endpoints, substituting board or card identifiers that belong to other roles or organizations. Because the handlers do not enforce ownership checks, the server returns the requested data or applies the requested modification. No user interaction is required beyond the attacker's own authenticated session.

For technical details on the vulnerable code paths, see the Metasfresh BoardRestController source and the HackMD analysis of the authorization issue.

Detection Methods for CVE-2026-111351

Indicators of Compromise

• Unexpected HTTP requests from low-privilege user sessions to /rest/api/board/* endpoints referencing board or card IDs outside the user's typical scope.
• Audit log entries showing getBoard, getCard, addCard, removeCard, or patchCard operations performed by accounts that do not normally interact with those boards.
• Spikes in sequential or enumerated board/card identifier access from a single authenticated session.

Detection Strategies

• Review application access logs for cross-organization or cross-role access patterns against the BoardRestController endpoints.
• Correlate REST API activity with the user's assigned role and organization to flag mismatches.
• Deploy custom detection rules that alert when a single user session accesses an unusually broad range of board IDs within a short interval.

Monitoring Recommendations

• Enable verbose request logging on the metasfresh backend and forward logs to a centralized analytics platform.
• Monitor for PATCH and POST operations against board endpoints that modify records outside the actor's organization.
• Track authentication events alongside API usage to identify compromised low-privilege accounts being abused for data access.

How to Mitigate CVE-2026-111351

Immediate Actions Required

• Inventory metasfresh deployments and confirm whether any instance runs version 5.175 or earlier.
• Restrict network access to the metasfresh REST API so only trusted internal clients can reach the board endpoints.
• Review audit logs for prior unauthorized access to board and card records and notify affected tenants if evidence is found.
• Rotate credentials for low-privilege accounts if suspicious activity is observed.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Monitor the metasfresh GitHub repository and the VulnCheck advisory for metasfresh for an official fix. Apply the patch to all production and staging environments once released, and validate that BoardRestController handlers enforce record-level authorization against the caller's role and organization.

Workarounds

• Place the metasfresh REST API behind a reverse proxy or API gateway that enforces per-role access control lists on the /board/* routes.
• Temporarily remove or disable low-privilege roles that do not require board access until a patch is available.
• Add a server-side filter or interceptor that validates the caller's organization against the requested board ID before the request reaches BoardRestController.

# Example reverse proxy restriction (nginx)
location /rest/api/v1/board/ {
    # Restrict board endpoints to administrators only
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://metasfresh-backend;
}