IT SBIT Services
Schneeberger
DEEN
CVE tracker

Manacle Technologies Multi-tenant ERP System: Account takeover via payment callback API

CVE-2026-107102Critical 9.3

← All vulnerabilities

Summary

A flaw in the payment callback API of the Manacle Multi-tenant ERP System lacks proper validation of payment callback parameters and adequate authentication controls. An unauthenticated remote attacker can manipulate a parameter so that the application creates an authenticated session for an arbitrary user, without valid payment verification. Successful exploitation allows bypassing authentication and gaining unauthorized access to other user accounts. CVSS 4.0 base score is 9.3 (Critical), but the affected versions and vendor patch status are not yet confirmed.

Affected

  • Manacle Technologies Multi-tenant ERP System, affected version: Unknown (sources only list a generic placeholder)

Fixed in

Unknown. No patched version has been published by the vendor in the sources reviewed. Contact Manacle Technologies for the patched version.

Workaround

  • Restrict or block access to the payment callback API endpoint until a patch is applied (generic recommendation from aggregator, not vendor-confirmed).
  • Restrict the callback endpoint to the payment provider's IP ranges at the firewall or reverse proxy.
  • Remove direct internet exposure of the ERP admin and API interfaces.

Exploitation

  • Exploited in the wild: Unknown. Not listed in CISA KEV.
  • CISA SSVC (Vulnrichment): Exploitation none, Automatable yes, Technical Impact total.
  • Public proof of concept: none found in the reviewed searches, which does not prove that none exists.
  • EPSS: 0.00255 (Vulners). VulDB lists activity as very low.

Our recommendation

  • Check whether any client runs Manacle ERP and whether it is reachable from the internet.
  • Ask Manacle Technologies for affected versions, a patch, and whether the callback endpoint is exposed in a default installation.
  • Restrict the payment callback endpoint now and review logs for callback requests and sessions created for other users.
  • Obtain the full text of CERT-In advisory CIVN-2026-0430 to confirm the CVE's inclusion and check the other Manacle issues in the same batch, including an exposed .git directory (CVE-2026-84149).
  • Verify the NVD status and the CVSS score directly at the source, as sources differ (VulDB 7.3, Vulners 6.2).

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:07.

Original description (NVD)

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed