Description
This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users on the targeted system.
Published: 2026-09-01
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Data Exposure
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an insecure direct object reference that allows an unauthenticated remote attacker to manipulate a request parameter on an API endpoint. By exploiting this flaw the attacker can read sensitive data that belongs to other users within the multi‑tenant ERP system. The flaw arises from improper authentication and authorization checks, leading to a confidentiality breach.

Affected Systems

Affected systems consist of the multi‑tenant Enterprise Resource Planning application produced by Manacle Technologies. Specific version details have not been disclosed, so any deployment of that ERP platform should be evaluated.

Risk and Exploitability

The flaw carries a CVSS score of 9.2, indicating a high severity and potential for significant impact. No EPSS score is available, but the vulnerability has not been reported in the CISA KEV catalog. The attack requires no privileged user credentials and can be carried out remotely by submitting a crafted request to the API endpoint, making it readily exploitable for a determined attacker.

Generated by OpenCVE AI on September 1, 2026 at 13:37 UTC.

Remediation

Vendor Solution

Contact the vendor for the patched version.

OpenCVE Recommended Actions

  • Contact the vendor to obtain and deploy the patched version of the ERP system.
  • Verify that all API endpoints enforce proper authentication and authorization checks before allowing access to user data.
  • Apply input validation and enforce least privilege on all data access controls to prevent unauthorized data retrieval.
  • Monitor API traffic for anomalous requests and review logs for potential misuse.

Generated by OpenCVE AI on September 1, 2026 at 13:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Manacle Technologies
Manacle Technologies multi-tenant Erp System
Vendors & Products Manacle Technologies
Manacle Technologies multi-tenant Erp System

Tue, 01 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users on the targeted system.
Title Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System
Weaknesses CWE-639
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Manacle Technologies Multi-tenant Erp System
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-In

Published:

Updated: 2026-09-01T15:39:38.556Z

Reserved: 2026-09-01T07:29:59.722Z

Link: CVE-2026-84148

cve-icon Vulnrichment

Updated: 2026-09-01T15:39:33.249Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T13:20:08.923

Modified: 2026-09-01T16:17:31.830

Link: CVE-2026-84148

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:14:45Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key