CVE-2026-72600

Executive Summary

CVE-2026-72600 is a broken access control vulnerability in Idurar IDURAR ERP CRM version 4.1.0 that allows unauthenticated remote attackers to download invoice PDF files containing customer personally identifiable information (PII). The vulnerability stems from the /download router being mounted without authentication middleware, exposing it publicly. Attackers can enumerate MongoDB ObjectIds to retrieve any invoice in the system without credentials. This vulnerability carries a CVSS score of 7.5 (High), is classified under CWE-284 (Improper Access Control), and remains unpatched with no vendor fix or workaround available.

Affected organizations: Enterprise deployments of the Idurar ERP CRM platform running version 4.1.0, specifically environments where the application is exposed to the internet or untrusted networks.

Impact: Unauthenticated disclosure of sensitive customer PII embedded in invoice PDFs, leading to privacy breaches, regulatory non-compliance (GDPR, CCPA), and potential downstream fraud or social engineering campaigns.

Technical Analysis

The vulnerability resides in the Idurar ERP CRM 4.1.0 application, specifically in a router path identified as /download. The NVD description indicates that this router is mounted without authentication middleware, meaning no session validation, token checks, or access-control enforcement occurs before the route handler executes.

Vulnerability Mechanism

The flaw is a classic broken access control (CWE-284) issue. The mechanism can be broken down as follows:

1. Unauthenticated Route Exposure — The /download router is registered in the application's routing layer without being wrapped in authentication middleware. In typical web frameworks, middleware is applied to enforce session or token validation; its absence here means any HTTP request to this path reaches the handler directly.

2. Predictable Resource Identifiers — The invoice documents are referenced using MongoDB ObjectIds. MongoDB ObjectIds are 12-byte BSON values, typically rendered as 24-character hexadecimal strings. These IDs are not cryptographically random — they embed a 4-byte timestamp, a 5-byte random value, and a 3-byte counter. While the random portion adds some entropy, the structure is well-documented and enumerable in practice, especially if the timestamp component can be approximated (e.g., from deployment dates or other leaked metadata).

3. Missing Authorization Check — The handler for /download does not verify whether the requester owns the invoice, has a valid session, or possesses any authorization token. The NVD description states the router is "publicly accessible" and that invoice PDFs can be downloaded "without credentials."

Attack Surface

• Network exposure: Any instance of the Idurar ERP CRM reachable over HTTP/HTTPS.
• Protocol: Plain HTTP GET requests to the /download endpoint with an invoice identifier parameter.
• Data at risk: Invoice PDF files containing customer PII (names, addresses, contact details, tax identifiers, purchase history).
• Authentication state: None required (unauthenticated).

Technical Limitations of Available Data

The NVD description provides minimal implementation detail. It does not specify the exact parameter name for the ObjectId, the HTTP method required, or the framework's routing conventions. Therefore, this report describes the vulnerability at the class level (URL path and mechanism) without fabricating additional endpoint parameters or code-level details.

Exploitation Scenarios

No public PoC or exploit code is currently available. The attack chain below is inferred from the vulnerability class (broken access control) and the specific details provided in the NVD description.

Step 1: Reconnaissance and Target Identification

The attacker first identifies internet-facing Idurar ERP CRM instances. This can be accomplished via:

• Shodan/Censys queries for common Idurar login pages or application fingerprints (see Shodan Dorks in Metadata).
• Google dorking for exposed Idurar instances.
• Banner grabbing or HTTP title inspection.

Step 2: Flaw Trigger — Unauthenticated Access to /download

The attacker sends an HTTP GET request directly to the /download router path on the target. Because the router is mounted without authentication middleware, the application processes the request without any session or credential validation. No login or API token is required.

Step 3: Resource Enumeration and Payload Execution

The attacker must supply a MongoDB ObjectId to retrieve a specific invoice. The enumeration approach:

1. ID structure analysis: MongoDB ObjectIds follow the format: [4-byte timestamp][5-byte random][3-byte increment counter].
2. Timestamp approximation: The attacker can estimate the deployment timestamp from publicly visible metadata (e.g., TLS certificate issuance date, HTTP headers, or application banners).
3. Brute-force iteration: The 5-byte random component allows for deterministic enumeration if the timestamp is known and the random seed space is sufficiently searched. In practice, even without precise timestamp knowledge, attackers can iterate through plausible timestamp windows and random-value combinations.
4. Request pattern: For each candidate ObjectId, the attacker submits a request to /download with the ID as a parameter (exact parameter name not disclosed in the NVD description).

Step 4: Post-Exploitation Impact

Upon a successful match, the server returns the invoice PDF containing customer PII. The attacker can:

• Harvest personal data: Collect names, physical addresses, email addresses, phone numbers, and possibly financial data (tax IDs, bank details if present on invoices).
• Scale exploitation: Automate the enumeration to download large volumes of invoices, exfiltrating the entire customer database embedded in PDF documents.
• Enable downstream attacks: Use collected PII for targeted phishing, identity theft, or credential-stuffing campaigns against both the ERP users and its customers.

Impact Assessment

Business Impact

Regulatory and Legal Consequences

• GDPR (EU): Unauthorized disclosure of personal data constitutes a data breach requiring notification within 72 hours; fines up to 4% of global annual turnover.
• CCPA/CPRA (California): Civil penalties for failure to protect consumer PII.
• PCI DSS (if cardholder data present): Potential fines and revocation of processing privileges.
• Industry-specific: HIPAA (if health data on invoices), GLBA (financial institutions).

Blast Radius

• Directly affected: Idurar ERP CRM 4.1.0 deployments.
• Indirectly affected: All customers whose PII appears on invoice PDFs; supply chain partners relying on Idurar for order processing.
• Reputational damage: Public disclosure of an unpatched PII leak erodes customer trust and partner confidence.

ATT&CK Mapping

• Tactic: Initial Access
• Technique: T1190 — Exploit Public-Facing Application

Detection Guidance

Sigma Rule

title: Idurar ERP CRM Unauthenticated Invoice Download Attempt
id: 8f3c2a1b-9e4d-4f5a-8b6c-1d2e3f4a5b6c
status: experimental
description: Detects unauthenticated access attempts to the /download endpoint of Idurar ERP CRM, indicative of CVE-2026-72600 exploitation.
author: Valtersit Threat Intelligence
logsource:
  category: webserver
  product: apache
  definition: 'Web server access logs from Idurar ERP CRM instances'
detection:
  selection:
    c-uri|startswith: '/download'
    sc-status: 200
  filter_known_clients:
    c-ip:
      - '127.0.0.1'
      - '::1'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_known_clients
falsepositives:
  - Legitimate unauthenticated static resource downloads if /download serves other files
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-72600

YARA Rule

rule Idurar_ERP_Invoice_Exfiltration_CVE_2026_72600 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects PDF files that match Idurar ERP invoice patterns, potentially exfiltrated via CVE-2026-72600"
        date = "2026-06-10"
        cve = "CVE-2026-72600"
        severity = "high"
    strings:
        $pdf_header = "%PDF-" ascii
        $idurar_ref = "Idurar" ascii nocase
        $invoice_label = "Invoice" ascii nocase
        $order_id = "Order" ascii nocase
        $tax_label = "Tax ID" ascii nocase
        $customer_ref = "Customer" ascii nocase
    condition:
        $pdf_header at 0 and 2 of ($idurar_ref, $invoice_label, $order_id, $tax_label, $customer_ref)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Idurar ERP CRM Unauthenticated /download Access - CVE-2026-72600"; flow:established,to_server; http.uri; content:"/download"; http.method; content:"GET"; http.request_line; content:!".*session.*" nocase; sid:2026072600; rev:1; classtype:attempted-recon; reference:cve,2026-72600; priority:2;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where dns.question.name like "*idurar*" or http.request.body.content like "*idurar*" ]
  [ http where http.request.method == "GET" and url.path == "/download" and not network.direction == "egress" ]
  [ file where event.action == "open" and file.extension == "pdf" and file.path like "*invoice*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "/download%")
| eval is_authenticated=if(isnotnull(session_id), "yes", "no")
| search is_authenticated="no"
| stats count by clientip, uri_path, status, _time
| where count > 5
| table _time, clientip, uri_path, status, count
| sort - _time

Wazuh OSSEC Rule

<group name="idurar, web,">
  <rule id="100260" level="12">
    <if_sid>31122</if_sid>
    <match>/download</match>
    <regex>GET /download</regex>
    <description>Idurar ERP CRM: Unauthenticated /download access attempt - CVE-2026-72600</description>
    <group>access_control,bad_requests,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No patch evidence exists from any tracked source. The vendor has not released a fix, and no version update addresses this vulnerability as of this report's date.

Immediate Mitigations (CSOC Actions)

1. Network-level blocking: Deploy WAF rules or firewall ACLs to block external access to any URI path beginning with /download on Idurar ERP CRM instances.
2. Access restriction: If the application must remain accessible, restrict the /download endpoint to internal IP ranges or VPN-only access.
3. Instance isolation: Place the Idurar ERP CRM behind a reverse proxy (Nginx, HAProxy) and deny all requests to /download unless they originate from authenticated internal users.
4. Monitor logs: Enable detailed web-server access logging and alert on repeated /download URI hits from single IPs (indicative of enumeration).

Patch / Upgrade Steps

1. No official patch available. Monitor vendor channels (Idurar releases, GitHub repository commits, security advisories) for a patched version.
2. If using Docker: Pin the container image version and watch for tags containing 4.1.1 or higher with security fixes.
3. If using source code: Check for any hotfix commits to the routing/auth middleware files in the public repository.

Long-Term Hardening

1. Apply authentication middleware to all sensitive routes, including /download, ensuring session validation occurs before handler execution.
2. Replace MongoDB ObjectIds in URLs with unpredictable tokens (e.g., UUIDv4) to prevent enumeration.
3. Implement rate limiting on invoice download endpoints to slow automated enumeration.
4. Add audit logging with user attribution for all document downloads.
5. Conduct a broader access-control review of the entire Idurar codebase — if one router was missed, others likely exist.
6. Enable data-at-rest encryption for stored invoices and data-in-transit encryption (TLS) to protect PII even if exfiltrated.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72600
2. MITRE CWE-284: https://cwe.mitre.org/data/definitions/284.html — Improper Access Control
3. MongoDB ObjectId Documentation: https://www.mongodb.com/docs/manual/reference/method/ObjectId/ — Documentation on ObjectId structure enabling enumeration
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application
5. CISA KEV: Not listed (no known exploitation in the wild as of this report).

Threat actor campaigns: No known threat actor campaigns have been attributed to this specific CVE. No exploit-in-the-wild evidence has been published. The EPSS score is not yet available from FIRST.org.