CVE-2026-92752 metasfresh CVE debrief

Who should care

Defenders and administrators of metasfresh systems, especially those with publicly accessible endpoints, should assess exposure and prioritize verification and remediation. This includes reviewing and updating access controls for metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints. Security teams and vulnerability management teams should also review compensating controls for exposed systems while remediation is scheduled and  

Why it matters

CVE-2026-92752 is a high-severity vulnerability in metasfresh that allows unauthorized access to attachments and comments. Defenders should prioritize verification, especially in publicly accessible systems, and assess the need for compensating controls or monitoring.

• Verify exposure in metasfresh systems to prevent unauthorized access
• Assess the need for compensating controls or monitoring to prevent data breaches
• Review and update access controls for metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints

Technical summary

The metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints do not enforce record-level permissions, allowing attackers to enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access. This vulnerability requires verification of affected versions and remediation from official sources. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The exact scope of affected versions and systems requires verification from official sources.

Defensive priority

Defenders should prioritize verifying exposure, especially in systems using metasfresh, and assess the need for compensating controls or monitoring.

Recommended defensive actions

• Verify exposure in metasfresh systems, especially those with publicly accessible endpoints
• Assess the need for compensating controls or monitoring to prevent unauthorized access
• Review and update access controls for metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints
• Check for and apply any available patches or updates from the vendor
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description and source references indicate that metasfresh's DocumentAttachmentsRestController and CommentsRestController endpoints do not enforce record-level permissions, allowing unauthorized access to attachments and comments. However, the exact scope of affected versions and systems requires verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.