CVE-2026-92752

Name of the Vulnerable Software and Affected Versions metasfresh (affected versions not specified)

Description The 'DocumentAttachmentsRestController' and 'CommentsRestController' endpoints fail to enforce record-level permissions, verifying only that the user is authenticated. This allows authenticated attackers to enumerate sequential document identifiers to read, replace, or delete attachments and comments associated with records that their assigned role should not be able to access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.