CVE-2024-57190: Erxes Package Suffers from Incorrect Access Control Vulnerability
Summary
CVE-2024-57190: Erxes Incorrect Access Control vulnerability. Affects erxes versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Erxes is an open-source customer experience platform that provides tools for managing customer interactions, marketing, and sales. It is built on a modern tech stack and is designed to help businesses improve their customer engagement. However, versions prior to 1.6.1 are vulnerable to an Incorrect Access Control issue, which can allow unauthorized access to sensitive GraphQL endpoints.
Vulnerability Detail
The vulnerability arises from a flaw in the authentication mechanism of Erxes versions <1.6.1. An attacker can exploit this by manipulating the 'User' HTTP header to impersonate any user, thereby bypassing authentication checks. This allows the attacker to interact with any GraphQL endpoint, potentially leading to unauthorized data access and manipulation. The severity of this vulnerability is classified as HIGH, as it can lead to significant security breaches.
How To Fix
Latest published version: 2.0.5 as of 23 Oct 2026
npm install erxes@2.0.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
npm install erxes@1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional server-side checks to validate user permissions before processing requests to GraphQL endpoints. This can help mitigate the risk until the package is updated.
Conclusion
The Incorrect Access Control vulnerability in Erxes versions prior to 1.6.1 poses a significant security risk, allowing unauthorized access to GraphQL endpoints. It is crucial to update to the patched version to safeguard your application. Additionally, consider implementing temporary workarounds until the update can be applied.
See every vulnerability recorded for erxes →
FAQ
The vulnerability is an Incorrect Access Control issue that allows attackers to bypass authentication by manipulating the 'User' HTTP header.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to sensitive data and functionalities within the Erxes platform.
Yes, the patch is available in version 1.6.1 of the Erxes package. Updating to this version will resolve the issue.
If immediate updating is not possible, implement additional server-side checks to validate user permissions as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for erxes.
