| शीर्षक | Omega Solution HRM OS Latest Missing Authentication |
|---|
| विवरण | Omega Solution HRM OS contains a missing authentication vulnerability in the role permission retrieval functionality. The endpoint responsible for returning role permission assignments fails to enforce authentication before processing requests and accepts a user-controlled role identifier without verifying the identity of the requester. A remote attacker can directly invoke the endpoint and retrieve the complete permission set associated with arbitrary roles, including privileged administrative roles, without possessing valid credentials. The disclosed information exposes the application's authorization model and privileged capabilities, enabling enumeration of role permissions and facilitating subsequent targeted attacks against the application.
Affected Component:
Role Permission API
Affected Endpoint:
GET /role-permission/permission?roleId=<id>
Affected Parameter:
roleId
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-306: Missing Authentication for Critical Function
CWE-862: Missing Authorization
OWASP Top 10 2021: A01 – Broken Access Control |
|---|
| स्रोत | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/22 |
|---|
| उपयोगकर्ता | 4m3rr0r (UID 85795) |
|---|
| सबमिशन | 17/07/2026 07:39 PM (2 महीनों पहले) |
|---|
| संयम | 20/09/2026 11:31 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408065 [Omega Solution HRM OS तक 20260717 Role Permission API permission roleId कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|