CVE-2026-111351 metasfresh CVE debrief

Who should care

Defenders responsible for metasfresh installations, particularly those with low-privilege users accessing the /rest/api/board REST API, should assess exposure and prioritize remediation.

Why it matters

Defenders should care about CVE-2026-111351 because it allows authenticated low-privilege users to bypass access checks in metasfresh through 5.175, potentially leading to unauthorized data access and modification.

• Authenticated low-privilege users can read records outside their scope
• Authenticated low-privilege users can modify board card assignments
• Verification of user access controls is required to prevent unauthorized data access
• Remediation priority is low due to CVSS score of 2.3

Technical summary

The metasfresh application through version 5.175 contains a missing record-level authorization vulnerability in the BoardRestController. This vulnerability allows authenticated low-privilege users to bypass role and organization access checks when interacting with the /rest/api/board REST API. Specifically, attackers can use the getBoard, getCard, addCard, removeCard, and patchCard handlers to read records outside their scope and modify board card assignments.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in metasfresh installations, particularly for low-privilege users with access to the /rest/api/board REST API.

Recommended defensive actions

• Verify and remediate the vulnerability in metasfresh installations
• Restrict access to the /rest/api/board REST API for low-privilege users
• Monitor for suspicious activity related to the BoardRestController
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and advisories. The vulnerability was reported by an external source and has been validated by the CVE Program. The affected product, metasfresh, is a popular open-source application. The vulnerability has not been publicly exploited, but defenders should still prioritize remediation due to the potential for unauthorized data access and modification. The BoardRestController is a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.