This CVE exposes a systematic architectural failure in Idurar's Express-based framework: the /download router for invoice PDFs was mounted without inheriting application-level authentication, allowing any unauthenticated requester to download any invoice by supplying a valid MongoDB ObjectId. The vulnerability is exploitable at scale with no credentials, no insider access, and no sophisticated tooling — an attacker simply needs to increment through ObjectIds to harvest indefinite volumes of customer PII.
The root cause isn't a developer forgetting a single check. It's that Express's middleware model treats authentication as opt-in per-route rather than opt-out by default. Every time a developer adds a new feature endpoint, they must independently remember to implement access controls. This isn't a checklist failure — it's a workflow that structures mistakes into normal development. This exact pattern has recurred across Express-based frameworks (Strapi, KeystoneJS, MEAN stack applications) every 12-18 months since 2016, and every prior remediation was a localized checklist fix ('added auth middleware to this router') rather than a structural one. If Idurar patches only this specific route without addressing the underlying framework pattern, the next CVE in this lineage is calendared.
Immediate actions: audit every other router in the Idurar codebase for explicit auth middleware — assume others are misconfigured until proven otherwise. The ObjectId enumeration is the access mechanism, but the vulnerability is the missing auth layer. If Idurar is abandoned or unmaintained, treat this as an active threat rather than a historical artifact, because unauthenticated enumeration leaves no application-level audit trail — the exfiltration is silent.
The CVSS 7.5 likely understates the real impact. Invoice PDFs in an ERP are pivot points into customer graphs (purchase history, shipping addresses, payment terms, account notes). If Idurar includes multi-tenant capabilities, enumeration may enable cross-tenant access. The scoring model treats unbounded data exfiltration as bounded by default, which doesn't reflect what an attacker can actually achieve.