CVE-2026-111351
metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API
metasfresh metasfresh
CVSS
2.3LowExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.
Text from CVE List
Affected versions 1
- metasfreshaffected: all versions through 5.175CVE List
References 5
- vulncheck.com/advisories/metasfresh-through-5.175-authorization-bypass-via-rest-api-board-rest-apiAdvisoryvia CVE List
- hackmd.io/@hieuPenguinnn/metasfresh-board-rest-missing-record-authzExploitvia CVE List
- github.com/metasfresh/metasfresh/blob/5.175/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardRestController.java#L137-L220Referencevia CVE List
- github.com/metasfresh/metasfresh/blob/56dd881b972af4edb071e4f1261a55a8b1a9c4d7/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardDescriptorRepository.java#L473-L511Referencevia CVE List
- github.com/metasfresh/metasfreshReferencevia CVE List