CVE-2026-111351 Details

A missing record-level authorization vulnerability has been identified in the metasfresh ERP system, specifically in the BoardRestController of the WebUI REST API. This vulnerability allows authenticated low-privilege users to bypass role and organization access checks. As a result, attackers can manipulate Kanban board features by reading, moving, and deleting cards on any configured board, regardless of their assigned role or organization. The vulnerability is present in metasfresh versions through 5.175.

To address this vulnerability, metasfresh should implement role and organization access checks in the Board REST API. This includes threading 'UserRolePermissionsKey' into the SQL queries that retrieve board and card data, ensuring that only records the user is authorized to access are available. Additionally, the 'filterNewCardsView' endpoint should be updated to require authentication, similar to the other board-related handlers.