CVE-2026-92752

CVE-2026-92752 is a broken object-level authorization flaw (CWE-639) in metasfresh's REST API: the DocumentAttachmentsRestController and CommentsRestController endpoints only verify that the caller is authenticated and never check whether the caller's role is permitted to access the referenced record. An authenticated user can enumerate sequential document identifiers and, for each, list/read, replace, or delete attachments and comments belonging to records outside their permitted scope. This can expose sensitive business documents (e.g., invoices, contracts, internal notes) held on other users' or other roles' records, and allows tampering with or destroying that content. Any metasfresh deployment using the web UI REST API with multiple roles or restricted records is affected. Exploitation has not been observed: the issue is not in CISA's KEV and no public proof-of-concept is known.

What to do: Upgrade to the fixed metasfresh release once the vendor advisory identifies it, and in the interim restrict or place authentication/authorization checks in front of the DocumentAttachments and Comments REST endpoints (e.g., reverse-proxy rules or WAF). Audit attachment and comment records for unexpected reads, replacements, or deletions by low-privileged accounts, and review role definitions to confirm record-level access is enforced elsewhere. Note that the attack requires valid credentials, so also review and rotate accounts with low-privileged roles if misuse is suspected.