A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Weakness
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
Extended Description
Data can “bleed” from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. In the case of Servlets, developers sometimes do not understand that, unless a Servlet implements the SingleThreadModel interface, the Servlet is a singleton; there is only one instance of the Servlet, and that single instance is used and re-used to handle multiple requests that are processed simultaneously by different threads. A common result is that developers use Servlet member fields in such a way that one user may inadvertently see another user’s data. In other words, storing user data in Servlet member fields introduces a data access race condition.
Potential Mitigations
Related Attack Patterns
References
- https://github.com/datadrivenconstruction/OpenConstructionERP/
- https://github.com/datadrivenconstruction/OpenConstructionERP/releases/tag/v15.0.0
- https://github.com/datadrivenconstruction/OpenConstructionERP/security/advisories/GHSA-wfpw-cv5v-64j5
- https://vuldb.com/cve/CVE-2026-103544
- https://vuldb.com/submit/957984
- https://vuldb.com/vuln/412354
- https://vuldb.com/vuln/412354/cti