EUVD-2026-102495

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read...

CVE-2026-111351

The metasfresh software (versions through 5.175) is vulnerable to a missing record-level authorization flaw in the BoardRestController component. This vulnerability allows authenticated low-privilege users to bypass role and organization access checks by interacting with the /rest/api/board REST ...

CVE-2026-111351

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read...

CVE-2026-111351 metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read...

CVE-2026-111351 metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read...

CVE-2026-111351 metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read...

CVE-2026-111351: Authorization Bypass Through User-Controlled Key

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read...

Metasfresh authorization issue vulnerability

Versions of Metasfresh 5.175 and earlier have an authorization issue. This vulnerability stems from the absence of record-level authorization in the BoardRestController. Low-privilege users, after being authenticated, can bypass role and organization access checks. They can call the getBoard,...