CVE-2024-53855

Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis on the IT Service Management (ITSM) modules. A user who is authenticated and has view permissions for a ticket, can view the tickets of another organization they are not apart of. Users with following permissions are applicable: 1. `view_ticket_change` permission can view change tickets from organizations they are not apart of. 2. `view_ticket_incident` permission can view incident tickets from organizations they are not apart of. 3. `view_ticket_request` permission can view request tickets from organizations they are not apart of. 4. `view_ticket_problem` permission can view problem tickets from organizations they are not apart of. The access to view the tickets from different organizations is only applicable when browsing the API endpoints for the tickets in question. The Centurion UI is not affected. Project Tasks, although a "ticket type" are also **Not** affected. This issue has been addressed in release version 1.3.1 and users are advised to upgrade. Users unable to upgrade may remove the ticket view permissions from users which would alleviate this vulnerability, if this is deemed not-viable, Upgrading is recommended.

• CWE-653

• https://github.com/nofusscomputing/centurion_erp/pull/399Issue Tracking
• https://github.com/nofusscomputing/centurion_erp/pull/399/commits/61f34876ed0f8362f7185bd5eecfc830a9de5cb0Patch
• https://github.com/nofusscomputing/centurion_erp/releases/tag/1.3.1Release Notes
• https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-h9q2-fcc6-r65cMitigation, Vendor Advisory

Published

Nov 27, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53847The Trix rich text editor, prior to versions 2.1.9 and 1.3.3…5.1
• CVE-2024-53848check-jsonschema is a CLI and set of pre-commit hooks for js…7.1
• CVE-2024-53849editorconfig-core-c is theEditorConfig core library writte…4.8
• CVE-2024-5385A vulnerability, which was classified as problematic, has be…4.1
• CVE-2024-53850The Addressing GLPI plugin enables you to create IP reports …8.2
• CVE-2024-53851Discourse is an open source platform for community discussio…6.5
• CVE-2024-53856rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14…7.5
• CVE-2024-53857rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14…7.5
• CVE-2024-53858The gh cli is GitHub’s official command line tool. A securit…6.5
• CVE-2024-53859go-gh is a Go module for interacting with the `gh` utility a…7.5
• CVE-2024-5386In lunary-ai/lunary version 1.2.2, an account hijacking vuln…8.8
• CVE-2024-53860sp-php-email-handler is a PHP package for handling contact f…8.6