Comarch ERP Optima Incorrect Privilege Assignment Vulnerability Allowing Privileged Database Access

A vulnerability exists in Comarch ERP Optima clients prior to version 2026.4, where the application connects to the database using a high-privileged account, regardless of the user's application account. This flaw allows a local attacker controlling the client process to dump memory, extract database credentials, and gain privileged access to the database. The client application must be configured, but the user does not need to be logged in.

Impact

Exploitation of this vulnerability allows local attackers to access the database with elevated privileges, potentially leading to unauthorized data manipulation or access.

Remediation

Users can upgrade to Comarch ERP Optima version 2026.4 or later to address this vulnerability.