Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

OpenConstructionERP AI module may leak data to wrong session

CVE-2026-103544 · published 18 days ago
Summary

Versions of OpenConstructionERP up through 14.8.1 have a problem in the AI provider component that can let data be shown to the wrong user session when someone manipulates a request. The flaw can be triggered over the network, so an attacker could see information that belongs to another user. Updating the software to version 15.0.0 removes the issue, so apply the upgrade as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
datadrivenconstruction openconstructionerp 14.8.0
Original advisory text
datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-488Exposure of Data Element to Wrong Session
Timeline
Published1 Oct 2026
Updated15 Oct 2026
First seen1 Oct 2026
Sources
CVE-2026-103544 · NVD
CVE-2026-103544 · MITRE
CVE-2026-103544 · OSV
GHSA-wfpw-cv5v-64j5 · GHSA
Track software like this
Free during beta