cyfenced.com →

[ CVE-2026-111351 · Published 15 Oct 2026 ]

Vulnerability in metasfresh

CVSS 4.2 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References