Metasfresh releases up to and including version 5.175 contain a missing record‑level authorization check in the BoardRestController. The flaw is exposed through the /rest/api/board interface and allows authenticated users with low privileges to bypass role and organization access checks. Attackers can then invoke the getBoard, getCard, addCard, removeCard, and patchCard handlers, enabling them to read board data and card assignments that belong to other users or organizations, as well as to modify card assignments. This provides the attacker with unauthorized insight into and control over collaborative content, compromising confidentiality and integrity of the data.

The vulnerability affects metasfresh, all builds up through and including version 5.175. No other product or vendor variants are listed as affected.

The CVSS score of 2.3 indicates a low magnitude of impact and a limited exploitable surface. The EPSS score of 0.00228 suggests a very low probability of exploitation; it is not listed in the CISA KEV catalog. The likely attack vector requires network access to the REST API and a valid authenticated session; an attacker would need a user credential that does not hold full board‑level privileges. Once authenticated, exploiting the missing check is straightforward and does not require additional privilege escalation beyond the application layer.