THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-81031 (HIGH 7.2) — IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that t

[NVD] CVE-2026-81031 (HIGH 7.2) — IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that t

mednvdPublished 2026-08-26

CVE-2026-81031 CVSS: 7.2 HIGH Published: 2026-08-26T16:16:45.860

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-81031