MicroRealEstate vulnerabilities
Published CVEs affecting MicroRealEstate products: 5 record(s), with severity, exploitation and fixes.
CVE-2026-57871
High · 7.1
CWE-23 Jul 7, 2026
Relative Path Traversal in MicroRealEstate
Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files.
This issue affects MicroRealEstate: through 1.0.0-alpha3.
CVE-2026-57870
Medium · 5.3
CWE-639 Jul 7, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in MicroRealEstate
Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization.
This issue affects MicroRealEstate: through 1.0.0-alpha3.
CVE-2026-57869
High · 7.1
CWE-639 Jul 7, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in MicroRealEstate
Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization.
This issue affects MicroRealEstate: through 1.0.0-alpha3.
CVE-2026-57868
High · 7.1
CWE-639 Jul 7, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in MicroRealEstate
MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.
This issue affects MicroRealEstate: through 1.0.0-alpha3.
CVE-2026-57867
High · 8.8
CWE-288 Jul 7, 2026
Authentication Bypass Using an Alternate Path or Channel in MicroRealEstate
MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute-force One-Time Passwords (OTP) to log in as any user. This issue affects MicroRealEstate: through 1.0.0-alpha3.