| Título | Omega Solution Fulfillment by People 2025 (latest) Authorization Bypass |
|---|
| Descripción | Omega Solution Fulfillment by People 2025 contains an Insecure Direct Object Reference (IDOR) vulnerability in the user profile retrieval functionality. The application fails to enforce object-level authorization when processing requests to the user profile endpoint and directly trusts a user-controlled identifier to determine which profile record to return. An authenticated attacker can manipulate the user identifier in the request path to access profile information belonging to other users without authorization. Successful exploitation results in unauthorized disclosure of personally identifiable information (PII), including user names, email addresses, telephone numbers, postal addresses, account status, and role information, allowing enumeration of arbitrary user profiles and compromising data confidentiality.
Affected Component:
User Profile API
Affected Endpoint:
GET /user/{id}
Affected Parameter:
{id}
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization
OWASP Top 10 2021: A01 – Broken Access Control |
|---|
| Fuente | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/23 |
|---|
| Usuario | 4m3rr0r (UID 85795) |
|---|
| Sumisión | 2026-07-17 19:47 (hace 2 meses) |
|---|
| Moderación | 2026-09-20 23:31 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 408066 [Omega Solution FBP Fulfillment by People 2025 User Profile API /user/ ID escalada de privilegios] |
|---|
| Puntos | 20 |
|---|