| عنوان | Omega Solution Fulfillment by People 2025 (latest) Authorization Bypass |
|---|
| الوصف | Omega Solution Fulfillment by People 2025 contains an Insecure Direct Object Reference (IDOR) vulnerability in the user profile retrieval functionality. The application fails to enforce object-level authorization when processing requests to the user profile endpoint and directly trusts a user-controlled identifier to determine which profile record to return. An authenticated attacker can manipulate the user identifier in the request path to access profile information belonging to other users without authorization. Successful exploitation results in unauthorized disclosure of personally identifiable information (PII), including user names, email addresses, telephone numbers, postal addresses, account status, and role information, allowing enumeration of arbitrary user profiles and compromising data confidentiality.
Affected Component:
User Profile API
Affected Endpoint:
GET /user/{id}
Affected Parameter:
{id}
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization
OWASP Top 10 2021: A01 – Broken Access Control |
|---|
| المصدر | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/23 |
|---|
| المستخدم | 4m3rr0r (UID 85795) |
|---|
| ارسال | 17/07/2026 07:47 PM (2 أشهر منذ) |
|---|
| الاعتدال | 20/09/2026 11:31 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 408066 [Omega Solution FBP Fulfillment by People 2025 User Profile API /user/ معرف تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|