BeeS ERP: Missing authorization allows access to administrative console
Summary
BeeS Software Solutions ERP before 04 September 2026 does not check authorization on the administrative dashboard endpoint. Any low-privileged user who requests this endpoint directly can reach the administrative console. The console gives access to institutional, employee and student data. The CVE record describes this as an insecure direct object reference (IDOR) and lists CWE-639 and CWE-862. The CVSS 4.0 base score is 7.1 (High).
Affected
- BeeS Software Solutions ERP versions before 2026-09-04 (according to the CVE record)
- Exact version numbers: Unknown.
- Affected product line: Unknown. The research notes suggest an educational ERP, but this is not confirmed.
Fixed in
- Fixed from 2026-09-04 according to the CVE record.
- Exact fixed build number: Unknown. Request it from BeeS.
Workaround
- Vendor workaround: Unknown.
- Interim measures (not from the vendor): restrict access to admin paths by IP address or VPN at the reverse proxy or firewall.
- Review which accounts can reach admin functions.
- Check web logs for non-admin accounts requesting admin URLs.
Exploitation
- No exploitation evidence found as of 10 November 2026 (third-party aggregator data).
- Not listed in CISA KEV at the time of the research.
- No public exploit found in Metasploit or Exploit-DB.
- The CVE was published on 10 November 2026, so this status may change quickly.
Our recommendation
- Check whether BeeS ERP is in use and identify the product line.
- Check whether the admin portal is reachable from the internet.
- Limit admin paths to trusted networks or VPN.
- Review which logins (including students and external staff) can reach the system.
- Request the fixed build from BeeS and read the CISA CSAF document va-26-313-04.
- Monitor logs for access to admin URLs by non-admin accounts and re-check KEV and exploit sources in the coming days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126123 www.cve.org
- CISA CSAF document va-26-313-04 raw.githubusercontent.com
- CERT/CC VU#361400 (BeeS vendor track record) kb.cert.org
- OffSeq Radar threat entry (third-party aggregator) radar.offseq.com
- Strix CVE entry CVE-2026-126123 www.strix.ai
- BeeS Cloudilya about page (vendor) cloudilyaerp.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:03.
Original description (NVD)
BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.