CVE-2026-57868 - Vulnerability Details - OpenCVE

MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: through 1.0.0-alpha3.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Microrealestate	Microrealestate

No data.

No data.

References

Link	Providers
https://github.com/microrealestate/microrealestate
https://www.themissinglink.com.au/security-advisories/cve-2026-57868

History

Fri, 10 Jul 2026 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microrealestate Microrealestate microrealestate
Vendors & Products		Microrealestate Microrealestate microrealestate

Fri, 10 Jul 2026 06:45:00 +0000

Type	Values Removed	Values Added
Title		Broken Object‑Level Access Controls in MicroRealEstate PDF Generator

Wed, 08 Jul 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title	Broken Object-Level Access Controls in PDF Generator

Tue, 07 Jul 2026 17:15:00 +0000

Type	Values Removed	Values Added
Title		Broken Object-Level Access Controls in PDF Generator

Tue, 07 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 07 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: through 1.0.0-alpha3.
Weaknesses		CWE-639
References		https://github.com/microrealestate/microrealestate https://www.themissinglink.com.au/security-advisories/cve-2026-57868
Metrics		cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: TML

Published: 2026-07-07T05:18:54.645Z

Updated: 2026-07-07T13:31:57.313Z

Reserved: 2026-06-26T00:40:34.057Z

Link: CVE-2026-57868

Vulnrichment

Updated: 2026-07-07T13:31:54.085Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57868", "assignerOrgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "state": "PUBLISHED", "assignerShortName": "TML", "dateReserved": "2026-06-26T00:40:34.057Z", "datePublished": "2026-07-07T05:18:54.645Z", "dateUpdated": "2026-07-07T13:31:57.313Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "shortName": "TML", "dateUpdated": "2026-07-07T05:18:54.645Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639 Authorization bypass through User-Controlled key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "MicroRealEstate", "product": "MicroRealEstate", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.0.0-alpha3", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.\n\nThis issue affects MicroRealEstate: through 1.0.0-alpha3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.<p>This issue affects MicroRealEstate: through 1.0.0-alpha3.</p>"}]}], "references": [{"url": "https://github.com/microrealestate/microrealestate", "tags": ["product"]}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-57868", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Jake Cleland", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T13:31:49.257188Z", "id": "CVE-2026-57868", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T13:31:57.313Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57868", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T13:31:49.257188Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T13:31:54.085Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jake Cleland"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MicroRealEstate", "product": "MicroRealEstate", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.0-alpha3"}], "defaultStatus": "affected"}], "references": [{"url": "https://github.com/microrealestate/microrealestate", "tags": ["product"]}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-57868", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.\n\nThis issue affects MicroRealEstate: through 1.0.0-alpha3.", "supportingMedia": [{"type": "text/html", "value": "MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.<p>This issue affects MicroRealEstate: through 1.0.0-alpha3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization bypass through User-Controlled key"}]}], "providerMetadata": {"orgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "shortName": "TML", "dateUpdated": "2026-07-07T05:18:54.645Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57868", "state": "PUBLISHED", "dateUpdated": "2026-07-07T13:31:57.313Z", "dateReserved": "2026-06-26T00:40:34.057Z", "assignerOrgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "datePublished": "2026-07-07T05:18:54.645Z", "assignerShortName": "TML"}, "dataVersion": "5.2"}