GCVE - cpe:2.3:a:metasfresh:metasfresh:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:metasfresh:metasfresh:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-92752`	vulnerable	2026-10-13 12:28:53.789746	metasfresh Unauthorized Access via Document Attachments and Comments Endpoints HIGH (8.3) metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access. Published: 2026-09-16T20:32:24.865Z Updated: 2026-09-21T15:47:51.313Z Open on db.gcve.eu Reference links https://github.com/metasfresh/metasfresh/issues/24665 https://github.com/metasfresh/metasfresh https://github.com/metasfresh/metasfresh/blob/c4c7766ef403eb470c9130031cf24cc33625ceed/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/attachments/DocumentAttachmentsRestController.java#L63-L225 https://github.com/metasfresh/metasfresh/blob/c4c7766ef403eb470c9130031cf24cc33625ceed/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/upload/ImageRestController.java#L100-L107 https://www.vulncheck.com/advisories/metasfresh-unauthorized-access-via-document-attachments-and-comments-endpoints	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.