Aureus ERP up to version 1.6.0 suffers an authorization bypass that lets authenticated API users create or move records into companies they are not authorized to use by supplying any company_id value. This flaw tears apart the multi‑company data isolation, enabling attackers to access or manipulate records belonging to other companies and thus obtain unintended data. The weakness represents a classic user‑controlled key bypass and is classified as CWE‑639.

The affected product is Aureus ERP, version 1.6.0 and earlier releases prior to any correction. The vendor is aureuserp. The REST API endpoints for partners, sales, and inventories are impacted.

The CVSS score of 5.3 marks this issue as moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated API user and relies on sending crafted create or update requests with a foreign company_id to one of the affected endpoints. Based on the description, the likely attack vector is an authenticated remote API call; exploitation needs valid credentials and HTTP access to the service.