Aureus ERP versions up to 1.6.0 contain an authorization bypass that permits anyone to read unpublished draft blog posts without authentication. The flaw allows attackers to retrieve the full title, content, image, tags, author, and publish date by accessing the customer‑facing post view page, because the PostResource class skips the authorization check and the ViewPost page ignores the is_published flag. This vulnerability results in a confidential data disclosure rather than code execution or denial of service.

The vulnerability affects Webkul's Aureus ERP software running any release up to and including 1.6.0. Versions beyond 1.6.0 that have applied the described fix are not impacted.

With a CVSS score of 6.3, the vulnerability is considered moderate in severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no publicly known exploits have been reported. Exploitation requires only guessing or enumerating a valid post slug, after which an unauthenticated attacker can view the post’s contents. Because the flaw bypasses authorization, the attack is easy to carry out, but impact is limited to sensitive data disclosure and does not affect system integrity or availability.