CVE-2026-92752: Metasfresh

High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days.

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.

Affected products

• Metasfresh Metasfresh

Published 2026-09-16. Last modified 2026-09-23.