Erxes Incorrect Access Control vulnerability

CRITICAL 9.8CVE-2024-57190 · GHSA-7rhv-xm4q-wh42 · Published 10/06/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
erxes erxes	`< 1.6.1`	`1.6.1`
erxes npm	`< 1.6.1`	`1.6.1`

Description

Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint.

NVD description

Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint.

References

nvd.nist.gov/vuln/detail/CVE-2024-57190 · ADVISORY
erxes/erxes commit 4ed2ca7 · WEB
erxes/erxes · PACKAGE
sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices · WEB
sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free