CVE-2026-95655 Overview
CVE-2026-95655 is an Insecure Direct Object Reference (IDOR) vulnerability in Aureus ERP before version 1.5.0. The flaw resides in the ChatterPanel Livewire component, which fails to scope message lookups to the current record. Any authenticated user can submit sequential message IDs to read, edit, delete, or pin messages that belong to unrelated records, departments, or companies. Attackers can also enumerate every note in the system, resulting in cross-tenant data exposure. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Any authenticated Aureus ERP user can read, modify, or delete arbitrary Chatter messages and notes across all tenants by iterating message IDs.
Affected Products
- Aureus ERP versions prior to 1.5.0
- webkul/chatter plugin (ChatterPanel.php Livewire component)
- Confirmed vulnerable in Aureus ERP release v1.4.0
Discovery Timeline
- 2026-09-22 - CVE-2026-95655 published to the National Vulnerability Database
- 2026-09-22 - Last updated in NVD database
- Fixed in release - Aureus ERP v1.5.0 via pull request #1382 and commit d3d5ac20
Technical Details for CVE-2026-95655
Vulnerability Analysis
Aureus ERP exposes a Chatter subsystem that stores messages, notes, and activity logs attached to individual records. The ChatterPanel Livewire component handles message operations such as view, edit, delete, and pin. In v1.4.0, message lookups at ChatterPanel.php line 503 and line 685 resolve a message solely by its primary key. The component never validates that the requested message belongs to the currently loaded record or that the caller has authorization for the owning tenant.
An attacker with a low-privileged authenticated account can iterate integer message IDs and reach messages attached to any record, including those from other companies or departments. See the HackMD IDOR analysis and the VulnCheck advisory for reproduction details.
Root Cause
The root cause is missing object-level authorization on Chatter message operations. The Livewire endpoints trust the client-supplied messageId parameter and query the Message model directly without a scope clause restricting results to the panel's owning record and tenant.
Attack Vector
Exploitation requires only a valid authenticated session. The attacker calls the ChatterPanel Livewire actions with sequential or guessed message IDs to read, edit, delete, or pin arbitrary messages. No user interaction is required from the victim.
// Patch context from Aureus ERP commit d3d5ac20
use Webkul\Chatter\Filament\Infolists\Components\Messages\ContentTextEntry as MessageContentTextEntry;
use Webkul\Chatter\Filament\Infolists\Components\Messages\MessageRepeatableEntry;
use Webkul\Chatter\Filament\Infolists\Components\Messages\TitleTextEntry as MessageTitleTextEntry;
-use Webkul\Chatter\Models\Message;
use Webkul\Partner\Models\Partner;
use Webkul\Security\Models\User;
use Webkul\Support\Models\ActivityPlan;
Source: GitHub commit d3d5ac20. The patch removes the direct Message model import and refactors lookups so that message queries are scoped through the parent record's relationship, enforcing tenant boundaries.
Detection Methods for CVE-2026-95655
Indicators of Compromise
- Livewire POST requests to ChatterPanel endpoints referencing message IDs outside the record context loaded by the same user session.
- Sequential or wide-range enumeration of numeric messageId values from a single authenticated account.
- Unexpected edit, delete, or pin actions on Chatter messages attributed to users who never opened the parent record.
Detection Strategies
- Correlate application audit logs of Chatter actions with the record IDs each user is authorized to view; alert on mismatches.
- Inspect webserver access logs for high-frequency Livewire calls containing incrementing messageId parameters from one session.
- Review database audit trails on the chatter_messages table for updates or deletions issued by users lacking a business relationship to the owning record.
Monitoring Recommendations
- Enable verbose application logging for the webkul/chatter plugin and forward events to a centralized log platform.
- Baseline normal Chatter message access volumes per user and alert on statistical outliers.
- Monitor for authenticated sessions that touch messages spanning multiple company_id or department_id values within short windows.
How to Mitigate CVE-2026-95655
Immediate Actions Required
- Upgrade Aureus ERP to release v1.5.0 or later, which includes the ChatterPanel authorization fix.
- Audit Chatter message access and modification logs for the period preceding the upgrade to identify potential unauthorized access.
- Rotate credentials and review permissions for any account observed enumerating message IDs.
Patch Information
The fix is delivered in commit d3d5ac20 via pull request #1382 and shipped in Aureus ERP v1.5.0. The patch scopes message lookups in ChatterPanel.php through the parent record's relationship rather than resolving messages by primary key alone.
Workarounds
- Restrict access to Aureus ERP to trusted users only until the upgrade is complete.
- Place the application behind a reverse proxy or web application firewall (WAF) rule that rate-limits Livewire requests targeting Chatter message operations.
- Temporarily disable or restrict the webkul/chatter plugin functionality for lower-privileged roles if upgrade cannot be performed immediately.
# Upgrade Aureus ERP to the patched release
git fetch --tags
git checkout v1.5.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache
php artisan view:cache
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
