CVE-2025-60931 in Global HR
Summary
by MITRE • 07/29/2026
An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability under examination represents a critical insecure direct object reference flaw within the employee compensation viewing functionality of Infor Global HR version 11.24.10.01.33. This weakness fundamentally undermines the application's access control mechanisms by allowing attackers to bypass proper authentication and authorization checks. The issue manifests when users can manipulate URL parameters or request variables to directly access resources they should not have permission to view, specifically targeting compensation data of other employees within the system.
This type of vulnerability falls squarely under CWE-284 which defines inadequate access control as a fundamental security weakness in software applications. The technical implementation flaw occurs when the application fails to validate whether the requesting user has legitimate authorization to access specific employee compensation records. The system relies on predictable identifiers or sequential numbering schemes that can be easily manipulated through crafted GET requests, enabling unauthorized data exposure without proper session validation or role-based access controls.
The operational impact of this vulnerability extends far beyond simple information disclosure, as employee compensation data constitutes highly sensitive personal and financial information that organizations are legally obligated to protect. Attackers can exploit this weakness to gain comprehensive views of salary structures, bonus calculations, benefits packages, and other proprietary compensation details for multiple employees simultaneously. This creates potential for corporate espionage, competitive intelligence gathering, and individual privacy violations that could result in significant financial losses and regulatory penalties.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1213.002 which involves data from information repositories. The attack vector requires minimal technical expertise as it leverages standard web application manipulation techniques through simple URL parameter modification. Security controls such as input validation, access control checks, and proper session management are insufficiently implemented or bypassed entirely. Organizations may face compliance violations under regulations like gdpr, hipaa, and soc 2 standards when such vulnerabilities exist in systems handling sensitive employee data.
Mitigation strategies must address both immediate remediation and architectural improvements to prevent similar issues. The primary solution involves implementing robust access control validation at every request point where employee data is accessed, ensuring that each user can only retrieve information related to their own records or those explicitly permitted by their role. This includes server-side validation of user permissions, proper input sanitization, and implementation of proper authorization checks before any data retrieval operations occur. Organizations should also consider implementing rate limiting and logging mechanisms to detect suspicious access patterns and provide audit trails for security monitoring purposes. The fix requires comprehensive code review and testing to ensure that all functions accessing employee compensation data properly validate user credentials and authorization levels before returning any sensitive information.