CVE-2026-95655 Webkul CVE debrief

Who should care

Defenders and administrators of Aureus ERP deployments should assess exposure and prioritize patching to version 1.5.0 or later. This includes reviewing ChatterPanel configurations, verifying message scoping, and implementing additional monitoring to detect potential exploitation attempts. Security teams should also review incident response plans to address potential impacts of arbitrary message access. Additionally, operators and platform administrators,

Why it matters

CVE-2026-95655 allows authenticated users to access arbitrary messages in Aureus ERP before 1.5.0; defenders should assess exposure and prioritize patching.

• Authenticated users can access arbitrary messages.
• Message scoping issue allows for potential enumeration of all notes in the system.
• Patching to version 1.5.0 or later is required to fix the issue.
• Verify ChatterPanel access controls and message scoping.

Technical summary

Aureus ERP before 1.5.0 has an issue in ChatterPanel where message lookups are not scoped to the current record, allowing authenticated users to access arbitrary messages by submitting sequential message IDs. This vulnerability could lead to unauthorized access to sensitive information and potential enumeration of all notes in the system. The issue is addressed in version 1.5.0 or later, where message lookups are properly scoped to prevent such unauthorized access. Defenders should prioritize patching to version 1.5.0 or later and verify ChatterPanel access controls.

Defensive priority

Authenticated users can access arbitrary messages; verify ChatterPanel access controls and prioritize patching to version 1.5.0.

Recommended defensive actions

• Verify ChatterPanel access controls and message scoping in Aureus ERP versions before 1.5.0.
• Prioritize patching to Aureus ERP version 1.5.0 or later.
• Monitor for authenticated users accessing arbitrary messages.
• Review and restrict sequential message ID submissions.
• Conduct a thorough review of ChatterPanel configurations and ensure proper scoping of message lookups.
• Implement additional monitoring to detect potential exploitation attempts.
• Review and update incident response plans to address potential impacts of arbitrary message access.

Evidence notes

CVE-2026-95655 describes an issue in Aureus ERP before 1.5.0 where ChatterPanel fails to scope message lookups, allowing authenticated users to access arbitrary messages by submitting sequential message IDs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.