metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111351 · Microsoft / collected KEV context

cve-program · CVE-2026-111351

• https://hackmd.io/@hieuPenguinnn/metasfresh-board-rest-missing-record-authz
• https://github.com/metasfresh/metasfresh/blob/5.175/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardRestController.java#L137-L220
• https://github.com/metasfresh/metasfresh/blob/56dd881b972af4edb071e4f1261a55a8b1a9c4d7/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardDescriptorRepository.java#L473-L511
• https://github.com/metasfresh/metasfresh
• https://www.vulncheck.com/advisories/metasfresh-through-5.175-authorization-bypass-via-rest-api-board-rest-api

No related operational record is retained in the current change model.