CVE-2026-72600 Overview
CVE-2026-72600 is a broken access control vulnerability [CWE-284] in Idurar IDURAR ERP CRM version 4.1.0. The /download router is mounted without authentication middleware, exposing invoice PDF files to unauthenticated remote attackers. Attackers can enumerate MongoDB ObjectId values to retrieve any invoice in the system, including customer personally identifiable information (PII). No credentials, user interaction, or elevated privileges are required to exploit this issue over the network.
Critical Impact
Unauthenticated remote attackers can download arbitrary invoice PDFs containing customer PII by enumerating MongoDB ObjectIds against the exposed /download route.
Affected Products
- Idurar IDURAR ERP CRM 4.1.0
Discovery Timeline
- 2026-08-11 - CVE-2026-72600 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72600
Vulnerability Analysis
The vulnerability resides in the routing layer of IDURAR ERP CRM 4.1.0. The application registers a /download router that serves invoice PDF files but omits any authentication or session validation middleware. Any HTTP client can reach the route directly and request invoice resources by supplying a valid identifier.
Invoice records in the application are keyed by MongoDB ObjectId values. These 12-byte identifiers contain a timestamp component and are enumerable by attackers who understand their structure. An adversary can iterate through candidate identifiers and retrieve every invoice document persisted by the deployment.
Because invoices typically contain customer names, billing addresses, contact details, line items, and payment information, exploitation results in mass disclosure of business and personal data. The issue is categorized under [CWE-284: Improper Access Control].
Root Cause
The root cause is missing authorization enforcement on a sensitive route. The /download endpoint was mounted at the application level without being wrapped by the authentication middleware applied to other API routes. There is no ownership check tying the requesting user to the invoice being downloaded.
Attack Vector
Exploitation requires only network access to the IDURAR web interface. An attacker issues HTTP GET requests to the /download route with candidate MongoDB ObjectId values. Successful requests return PDF binaries; failed requests can be discarded. Automated enumeration allows bulk extraction of invoice data without any authentication token.
No verified proof-of-concept code is published. Refer to the IDURAR ERP CRM repository for source-level details on the affected router.
Detection Methods for CVE-2026-72600
Indicators of Compromise
- High-volume HTTP GET requests to the /download path from a single source IP address, particularly requests iterating through sequential or timestamp-adjacent ObjectId values.
- Successful 200 responses returning application/pdf content to unauthenticated sessions with no prior login activity.
- Anomalous outbound bandwidth from the IDURAR host tied to /download responses.
Detection Strategies
- Inspect web server and reverse proxy access logs for /download requests lacking session cookies or authorization headers.
- Correlate /download request patterns with authentication logs to identify PDF retrievals that have no associated login event.
- Deploy WAF rules that require valid session state before permitting requests to the /download route.
Monitoring Recommendations
- Alert on any client that requests more than a small threshold of distinct invoice identifiers within a short time window.
- Monitor for user agents and IP addresses associated with scripted enumeration against IDURAR endpoints.
- Track cumulative PDF download volume from the application and baseline it against normal business activity.
How to Mitigate CVE-2026-72600
Immediate Actions Required
- Restrict network exposure of the IDURAR ERP CRM instance to trusted networks or place it behind a VPN until a fix is applied.
- Apply authentication middleware to the /download router so it rejects unauthenticated requests.
- Add an authorization check that verifies the requesting user owns or has access to the requested invoice.
- Review access logs for signs of prior enumeration and notify affected customers if PII exposure is confirmed.
Patch Information
No vendor patch reference is listed in the NVD entry at the time of publication. Monitor the IDURAR ERP CRM repository for security-related commits and releases addressing the /download route.
Workarounds
- Front the application with a reverse proxy that enforces authentication on the /download path.
- Block external access to /download at the network edge and permit only internal service accounts.
- Rotate invoice identifiers to unpredictable UUIDs to reduce enumeration feasibility while a permanent fix is developed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
