{"id":"CVE-2026-111351","summary":"metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API","details":"metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.","modified":"2026-10-21T02:55:48.130715652Z","published":"2026-10-15T21:43:41.617Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111351.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111351.json"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/metasfresh-board-rest-missing-record-authz"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111351"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/metasfresh-through-5.175-authorization-bypass-via-rest-api-board-rest-api"},{"type":"PACKAGE","url":"https://github.com/metasfresh/metasfresh"},{"type":"ARTICLE","url":"https://github.com/metasfresh/metasfresh/blob/5.175/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardRestController.java#L137-L220"},{"type":"ARTICLE","url":"https://github.com/metasfresh/metasfresh/blob/56dd881b972af4edb071e4f1261a55a8b1a9c4d7/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardDescriptorRepository.java#L473-L511"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/metasfresh/metasfresh","events":[{"introduced":"0"},{"last_affected":"51e8b152335dd654b9dc72d2b246b617297498a6"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"5.175"}]},{"source":"DESCRIPTION","range":[{"introduced":"0"},{"last_affected":"5.175"}]}]}}],"versions":["release_5.175-merged","intensive_care_uat_80","intensive_care_uat_77","intensive_care_uat_73","intensive_care_hotfix_71","intensive_care_hotfix_69","intensive_care_hotfix_68","intensive_care_hotfix_67","intensive_care_hotfix_66","intensive_care_uat_59","intensive_care_uat_58","intensive_care_uat_57","intensive_care_uat_56","intensive_care_uat_52","intensive_care_uat_50","intensive_care_uat_41","intensive_care_uat_37","intensive_care_hotfix_36","intensive_care_uat_35","intensive_care_hotfix_31","intensive_care_hotfix_30","intensive_care_uat_29","intensive_care_uat_26","intensive_care_hotfix_25","intensive_care_uat_24","intensive_care_uat_23","intensive_care_uat_22","5.166","5.165","blonde_monkey_uat_38","5.164","5.163","5.162","5.161","master_20210120","help","master_20201216","5.153","5.146","happy_flower_1","yoyo_1","big_coconut_1","big_coconut_uat_2","big_coconut_4","secondary_opinion_3","invisible_croissant_1","gh6285-app_pre_integrate","5.139_master_armorer_2","5.135_youth_orchestra_1","5.132","5.132_last_christmas_1","5.131","5.128","5.115_RC1","5.113_RC2","5.113_RC1","20190624","20190625","5.100","5.98","5.96","5.95","5.91","5.90","5.81","5.80","5.79","5.78","5.77","5.76","20180925-1","5.74","5.73","5.72","5.71","5.70","5.69","5.68","20180625-1","5.58","5.50","20180309-1","20180306-1","20180221-1","20180219-1","20180206-1","20180129-1","20180116-1","20180115-3","20180112-1","20171218-2","jenkins-ops-update_release_from_master-101","jenkins-ops-update_release_from_master-99","jenkins-ops-update_release_from_master-98","20171116-1","5.35","20171113-1","jenkins-ops-update_release_from_master-96","jenkins-ops-update_release_from_master-93","20171022-1","5.31","jenkins-ops-update_release_from_master-91","jenkins-ops-update_release_from_master-90","jenkins-ops-update_release_from_master-89","jenkins-ops-update_release_from_master-88","jenkins-ops-update_release_from_master-87","20170927-1","20170925-1","jenkins-ops-update_release_from_master-86","20170919-2","20170913-1","jenkins-ops-update_release_from_master-84","20170907-1","20170901-2","20170905-3","jenkins-ops-update_release_from_master-82","5.22","20170811-1","jenkins-ops-update_release_from_master-79","5.21","20170810-1","20170809-2","20170809-1","20170808-1","20170807-1","jenkins-ops-update_release_from_master-78","jenkins-ops-update_release_from_master-77","2070724-1","jenkins-ops-update_release_from_master-75","jenkins-ops-update_release_from_master-74","jenkins-ops-update_release_from_master-72","20170626-2","20170626-1","jenkins-ops-update_release_from_master-70","20170620-1","jenkins-ops-update_release_from_master-69","jenkins-ops-update_release_from_master-68","jenkins-ops-update_release_from_master-67","20170607-1","jenkins-ops-update_release_from_master-66","jenkins-ops-update_release_from_master-53","v5.11","jenkins-ops-update_release_from_master-60","jenkins-ops-update_release_from_master-51","v5.10","jenkins-ops-update_release_from_master-50","v5.9","jenkins-ops-update_master_from_release-49","jenkins-ops-update_release_from_master-49","jenkins-ops-update_release_from_master-47","v5.7","RC-2017-17-20170428","v5.5","jenkins-ops-update_release_from_master-42","jenkins-ops-update_release_from_master-41","jenkins-ops-update_release_from_master-40","jenkins-ops-update_release_from_master-39","jenkins-ops-update_release_from_master-38","jenkins-ops-update_release_from_master-37","jenkins-ops-update_release_from_master-36","jenkins-ops-update_release_from_master-35","v5.3","jenkins-ops-update_release_from_master-34","v5.1","jenkins-ops-update_release_from_master-31","v5.2","mergerd_master_20170324-ts","jenkins-ops-update_release_from_master-30","jenkins-ops-update_release_from_master-29","jenkins-ops-update_release_from_master-26","jenkins-ops-update_release_from_master-25","jenkins-ops-update_release_from_master-20","jenkins-ops-update_release_from_master-18","jenkins-release_management-update_release-candidate_from_master-14","v4.42.41","v4.41.40","v4.40.39","v4.39.38","v4.38.37","v4.37.36","v4.36.35","v4.35.34","v4.34.33","v4.32.31","v4.31.30","v4.29.28","v4.28.27","v4.27.26","v4.26.25a","v4.26.25","v4.25.24a","v4.25.24","v4.24.23","v4.23.22","v4.21.20","v4.19.18c","v4.19.18b","v4.19.18","v4.18.17a","v4.18.17","v4.17.16","v4.16.15","v4.15.14","v4.13.12","v4.12.11","v4.11.10","v4.9.8b","v4.2.1","1ae21e9","4.1RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111351.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}