IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and never compares the two. The route is mounted behind the administrator token check only, so any valid administrator session is sufficient, and the sole ownership-like guard in the handler rejects a single hardcoded demo address. A caller can therefore set an arbitrary password on any other administrator account and sign in as it. The read handler in the same controller directory accepts an identifier the same way, which supplies the identifiers needed to pick a target.

CVE-2026-81031 describes a critical account takeover vulnerability in IDURAR ERP CRM affecting versions up to 4.1.1. The flaw resides in the updatePassword.js handler, which updates the password of whichever account ID is supplied in the URL path rather than the account associated with the authenticated session token. The route is protected only by an administrator token check, meaning any valid administrator can change another administrator's password. The only ownership guard is a hardcoded rejection of a single demo email address, providing negligible protection. By leveraging the read handler in the same controller to enumerate account identifiers, an attacker can target any administrator account. This effectively allows horizontal privilege escalation and full account takeover among administrator-level users. The vulnerability stems from a missing comparison between the authenticated user identity and the target identifier in the request.