metasfresh vulnerabilities
CVEs whose affected-version data names the metasfresh package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111351Medium· 4.2PoCmetasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, get…
▾ Twilightmetasfresh · metasfreshEPSS 0.28%via NVD
CVE-2026-92752High· 8.3PoCmetasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace,…
▾ Midnightmetasfresh · metasfreshEPSS 0.46%via NVD