The vulnerability resides in Aureus ERP’s ChatterPanel component, which does not enforce scoping on message lookup requests. Authenticated users can send any message identifier and the system will return the corresponding message regardless of the author’s department or company. This flaw permits reading, editing, deleting, or pinning messages that belong to other business units, effectively allowing one user to read or tamper with data that should be isolated. Because the attacker can enumerate message IDs, they can discover all notes present in the system, exposing sensitive information about other departments or customers. The weakness is a classic example of insufficient authorization checks (CWE‑639).

All installations of Aureus ERP versions earlier than 1.5.0 are affected. The vendor name is Aureus ERP, and the product is also Aureus ERP. Only releases prior to the 1.5.0 milestone lack the necessary scoping enforcement. There are no known partial mitigations in earlier releases.

The CVSS score of 8.6 classifies this flaw as high severity. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the system, so the vector is limited to legitimate user access, but since the flaw allows arbitrary access to any message, a compromised or low‑privilege user can effectively gain elevated privileges within the messaging subsystem. Preventing the attack requires restricting message IDs to the user's own scope, which the patched version implements. Because the attacker can iterate message IDs, enumeration is trivial and unchallenged.