CVE-2026-92752: metasfresh Authorization Bypass Vulnerability

CVE-2026-92752 Overview

CVE-2026-92752 is a broken access control vulnerability in the metasfresh enterprise resource planning (ERP) platform. The DocumentAttachmentsRestController and CommentsRestController endpoints verify only that a caller is authenticated. They do not enforce record-level authorization on the target document. An authenticated user with any valid role can enumerate sequential document identifiers and read, replace, or delete attachments and comments belonging to records outside their permission scope. The flaw is classified as an Insecure Direct Object Reference [CWE-639] affecting REST API surfaces exposed by the metasfresh backend.

Critical Impact
Any authenticated metasfresh user can read, overwrite, or delete attachments and comments on any document by iterating numeric identifiers, breaking tenant and role isolation across the ERP.

Affected Products

metasfresh ERP backend (de.metas.ui.web.base module)
DocumentAttachmentsRestController REST endpoints
CommentsRestController and related ImageRestController upload endpoints

Discovery Timeline

2026-09-16 - CVE-2026-92752 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92752

Vulnerability Analysis

The metasfresh backend exposes REST controllers that manage attachments, images, and comments attached to business documents such as sales orders, invoices, and partner records. The controllers accept a document identifier from the request path and operate on the underlying record without validating whether the calling role has access to that record.

Because metasfresh document identifiers are sequential integers, an authenticated attacker can iterate the ID space to discover valid documents. Once a valid ID is known, GET, PUT, and DELETE operations against the attachment or comment endpoints succeed regardless of the caller's role scope. This exposes attachments containing invoices, contracts, customer data, and internal correspondence across tenants and business units within the same instance.

The controller code referenced by the VulnCheck advisory shows the missing authorization checks in the DocumentAttachmentsRestController source and the ImageRestController source.

Root Cause

The controllers rely on session authentication as the sole authorization gate. They omit calls to metasfresh's role-based access control layer that would confirm the current user can read or modify the target AD_Table_ID/Record_ID tuple. This is a textbook Insecure Direct Object Reference [CWE-639].

Attack Vector

An attacker needs only low-privilege authenticated access, such as a standard employee account. They send authenticated HTTP requests to the vulnerable REST paths and iterate the numeric document identifier. Successful requests return attachment metadata and file contents, accept replacement uploads, or delete existing artifacts.

The vulnerability manifests over the network through the standard metasfresh web API. No user interaction and no elevated privileges are required. See the Metasfresh issue #24665 for tracked remediation discussion.

Detection Methods for CVE-2026-92752

Indicators of Compromise

Sequential enumeration of numeric document identifiers on /rest/api/attachments, /rest/api/comments, and image upload endpoints from a single authenticated session.
Unexpected HTTP PUT or DELETE requests to attachment or comment resources by users whose role should not touch those documents.
Spikes in HTTP 200 responses for attachment downloads from accounts that historically only view a narrow document set.

Detection Strategies

Correlate authenticated web session identifiers with the AD_Table_ID/Record_ID scope granted to the associated metasfresh role and alert on mismatches.
Baseline per-user attachment access volume and flag deviations that resemble ID enumeration.
Ingest metasfresh application and reverse-proxy access logs into a centralized analytics platform for cross-request correlation.

Monitoring Recommendations

Enable verbose access logging on the metasfresh backend and forward logs to a SIEM or data lake for retention and query.
Monitor for a single account issuing many attachment or comment requests with monotonically increasing identifiers within a short window.
Track file replacement and deletion operations against attachment endpoints and require review when they occur outside change windows.

How to Mitigate CVE-2026-92752

Immediate Actions Required

Restrict network access to the metasfresh REST API to trusted internal networks or VPN clients until a patched build is deployed.
Audit metasfresh role assignments and remove or downgrade accounts that do not require document access.
Review recent attachment and comment activity for signs of unauthorized reads, replacements, or deletions.

Patch Information

No fixed version is listed in the NVD entry at publication. Track remediation progress on the upstream metasfresh issue #24665 and monitor the metasfresh GitHub repository for a security release. Apply the vendor patch to de.metas.ui.web.base as soon as it becomes available and validate that record-level permission checks are enforced in DocumentAttachmentsRestController, CommentsRestController, and ImageRestController.

Workarounds

Place the metasfresh backend behind a reverse proxy or web application firewall that blocks unauthenticated and anomalous access to /rest/api/attachments, /rest/api/comments, and image upload paths.
Add rate limiting per authenticated session on attachment and comment endpoints to slow identifier enumeration.
Implement application-layer authorization filters that reject requests where the caller's role does not grant access to the target AD_Table_ID/Record_ID.
Rotate credentials and review audit logs for any account suspected of enumerating document identifiers.

bash

# Example nginx rule to limit attachment enumeration until patched
limit_req_zone $binary_remote_addr zone=metasfresh_attach:10m rate=10r/m;

location ~ ^/rest/api/(attachments|comments|image)/ {
    limit_req zone=metasfresh_attach burst=5 nodelay;
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://metasfresh_backend;
}