CVE-2026-95655

Executive Summary

CVE-2026-95655 is an authorization flaw (CWE-639, Authorization Bypass Through User-Controlled Key) in Aureus ERP versions prior to 1.5.0, specifically within the ChatterPanel component. The vulnerability allows any authenticated user to access, modify, delete, or pin messages belonging to other departments or companies by supplying arbitrary or sequential message identifiers, because message lookups are not scoped to the currently viewed record. With a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and no public exploit or patch evidence tracked, organizations running exposed Aureus ERP instances should treat this as a high-priority broken access control issue requiring immediate version upgrade and compensating controls.

Technical Analysis

The root cause is an Insecure Direct Object Reference (IDOR) / user-controlled key authorization failure (CWE-639) in the ChatterPanel message-handling logic. In a correctly implemented messaging or activity-stream component, a message request is bound to the record (and its owning department or company) that the requesting user is authorized to view. In vulnerable Aureus ERP versions before 1.5.0, the message lookup is not scoped to the current record — the application resolves the message based solely on a supplied message identifier and does not validate that this identifier belongs to a record or organizational unit the caller may access.

Because message identifiers appear to be sequential or otherwise predictable, the confidentiality and integrity boundary between departments and companies collapses: an authenticated low-privilege user can enumerate identifiers to retrieve, edit, delete, or pin messages (and, per the description, enumerate all notes) belonging to unrelated organizational units. The attack surface is the network-exposed ERP messaging/activity endpoint, requiring only a valid authenticated session (PR:L, AV:N, AC:L) and no user interaction (UI:N).

The CVSS subscores are internally consistent with this class: scope is unchanged (S:U) because the flaw stays within the ERP application's authorization model, while confidentiality and integrity impacts are high (C:H/I:H) because arbitrary cross-tenant message data can be read and mutated. Availability is unaffected (A:N). No function names, routes, or parameters beyond the component name "ChatterPanel" are specified in the source description; no code-level identifiers should be assumed beyond that component.

Because no patch source, vendor advisory, OSV package mapping, or fixed-version artifact has been tracked, patch confidence remains 0/4 (UNPATCHED). The NVD description references version 1.5.0 as the presumed fixing release, but this has not been corroborated by any tracked patch evidence.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists (POC_STATUS: None). The attack chain below is described at the vulnerability-class level and is inferred strictly from the NVD description.

1. Reconnaissance / target identification. The attacker identifies a network-reachable Aureus ERP instance (pre-1.5.0) and obtains an authenticated low-privilege account. This is a standard prerequisite for ERP access and may be satisfied by a legitimate low-privilege user, a contractor, or a compromised credential. The attacker also needs to understand that the ChatterPanel message endpoint accepts a message identifier that is not scoped to the caller's current record.

2. Triggering the flaw (IDOR / user-controlled key). From within ChatterPanel, the attacker submits a message identifier that does not belong to the record or department/company they are authorized to view. Because the backend does not validate the identifier against the current record and its organizational scope, the lookup returns or acts on the referenced message directly. The precondition is only that the identifier be valid and referenceable; the source description states such identifiers are effectively enumerable (sequential or otherwise predictable).

3. Payload / execution at the class level. This is an authorization-bypass class of attack — there is no injection payload or code-execution primitive. "Exploitation" consists of iterating candidate message identifiers and issuing read, edit, delete, or pin operations against them. The attacker exercises the same legitimate ChatterPanel operations available to their account, only pointing them at identifiers outside their authorization scope. No specific query parameters, API paths, or function names are disclosed in the available description and none should be assumed.

4. Post-exploitation impact. Successful enumeration yields read access to messages and all notes across departments and companies (confidentiality loss), the ability to tamper with, delete, or pin arbitrary messages (integrity loss), and potential business-process disruption through falsified or removed activity records. The high integrity impact also enables data manipulation that could mislead audit trails or downstream workflows. There is no described availability impact, consistent with the A:N subscore.

Impact Assessment

The affected product is Aureus ERP, a multi-department / multi-company business application; the vulnerable component is ChatterPanel. Any organization running Aureus ERP before 1.5.0 is in scope. Because the flaw is a cross-tenant/cross-department authorization failure affecting the ERP's internal messaging and notes, the blast radius can extend across the entire organizational boundary enforced by the ERP: a single authenticated low-privilege user can potentially reach messages and notes belonging to every department and company configured in the instance.

Business impact centers on confidentiality and integrity:

• Confidentiality (C:H): exposure of internal communications, notes, and potentially sensitive operational or financial context across departmental and corporate boundaries.
• Integrity (I:H): unauthorized edit, deletion, or pinning of messages, enabling record tampering and disruption of internal communications.
• Availability (A:N): no direct impact described.

The CVSS 3.1 base of 8.1 reflects network reachability with low attack complexity and low privileges required, and high confidentiality and integrity impact. There is no CISA KEV listing and no known in-the-wild exploitation evidence at time of writing; EPSS has not been scored by FIRST.org. Scope is unchanged, so the impact remains within the ERP authorization domain rather than pivoting into the host operating system or other tenants outside the application's model.

Detection Guidance

Sigma Rule

title: Aureus ERP ChatterPanel Cross-Record Message Access (CVE-2026-95655)
id: 7b1f2c9a-3d64-4e21-9c0a-aureus95655
status: experimental
description: Detects authenticated access to ChatterPanel messages referencing records outside the caller's authorized scope, consistent with CWE-639 IDOR in Aureus ERP < 1.5.0
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95655
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: aureus_erp
detection:
  selection_component:
    component: 'ChatterPanel'
  selection_action:
    action:
      - 'read'
      - 'edit'
      - 'delete'
      - 'pin'
      - 'view'
  selection_message_ref:
    message_id|exists: true
  filter_authorized:
    scope_match: true
  condition: selection_component and selection_action and selection_message_ref and not filter_authorized
fields:
  - user
  - message_id
  - record_id
  - scope_match
  - src_ip
falsepositives:
  - Legitimate cross-department access by privileged administrators
  - Logging pipelines that do not populate the scope_match field
level: high

YARA Rule

rule CVE_2026_95655_Aureus_ChatterPanel_IDOR
{
    meta:
        description = "Detects references to ChatterPanel message handling in Aureus ERP sources/artifacts consistent with unscoped message lookup (CVE-2026-95655, CWE-639)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95655"
        date = "2026-01-01"
        severity = "high"

    strings:
        $chatter = "ChatterPanel" ascii wide nocase
        $msg1 = "message_id" ascii wide nocase
        $msg2 = "messageId" ascii wide nocase
        $msg3 = "message" ascii wide nocase

    condition:
        $chatter and any of ($msg*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95655 Aureus ERP ChatterPanel Possible IDOR Message Enumeration"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"ChatterPanel"; nocase; http.uri; pcre:"/(message|msg)[_-]?id=[0-9]{1,}/i"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:cve,2026-95655; sid:9565501; rev:1;)

Elastic Detection

sequence by user.name with maxspan=60s
  [ any where event.category == "web" and process.name != null and
      stringContains(url.path, "ChatterPanel") ]
  [ any where event.category == "web" and
      stringContains(url.path, "ChatterPanel") and
      stringContains(url.query, "message") ]

Splunk SPL Query

index=web OR index=erp sourcetype=aureus:access
| search uri_path="*ChatterPanel*"
| rex field=uri_query "message[_-]?id=(?<message_id>\d+)"
| where isnotnull(message_id)
| stats count dc(message_id) as distinct_msgs values(message_id) as msg_ids by src_ip, user
| where distinct_msgs > 15
| sort - distinct_msgs

Wazuh OSSEC Rule

<group name="aureus,web,access_control,">
  <rule id="956550" level="10">
    <decoded_as>json</decoded_as>
    <field name="component">ChatterPanel</field>
    <field name="action">\.+</field>
    <description>CVE-2026-95655: Aureus ERP ChatterPanel message access recorded - verify record scope authorization</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (compensating controls):

   • Restrict network access to the Aureus ERP instance (VPN, IP allowlisting, or reverse-proxy ACLs) so only trusted networks and users can reach ChatterPanel functionality.
   • Enforce least privilege: audit ERP roles and remove unnecessary authenticated access to messaging/notes features for low-privilege accounts.
   • Add application-layer authorization enforcement (e.g., a WAF or gateway rule) that rejects ChatterPanel message requests where the referenced message is not scoped to the caller's current record/department/company, if such inspection is feasible.
   • Enable detailed access logging for ChatterPanel operations (read/edit/delete/pin) with user, message identifier, and record scope, and monitor for sequential identifier enumeration.

2. Patch / upgrade steps:

   • Upgrade to Aureus ERP 1.5.0 or later, which the NVD description identifies as the release where message lookups are scoped to the current record. Since no vendor advisory is currently tracked, verify the official Aureus distribution channel for the authoritative fixed build before deployment.
   • After upgrading, re-verify that message, note, and pin operations correctly enforce record- and organizational-scope authorization.

3. Long-term hardening:

   • Adopt object-level authorization checks on every message/note lookup, ensuring identifiers are always validated against the caller's authorized record and organizational scope (addresses CWE-639 systematically, not just this instance).
   • Replace predictable, sequential identifiers with non-guessable identifiers as defense in depth, while still enforcing server-side authorization.
   • Implement continuous authorization testing (unit/integration + periodic IDOR-focused assessment) in the SDLC for ERP components.
   • Maintain an SBOM/asset inventory for ERP deployments to accelerate future patch response.

References

• NVD — CVE-2026-95655: https://nvd.nist.gov/vuln/detail/CVE-2026-95655
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• OWASP — Insecure Direct Object Reference (IDOR): https://owasp.org/www-community/attacks/Insecure_Direct_Object_Reference
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog (no listing for CVE-2026-95655 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-95655 in the available data. CISA KEV: NO. No public PoC, exploit code, or Nuclei template is known. EPSS has not been scored by FIRST.org.