| タイトル | Omega Solution Fulfillment by People 2025 (latest) Authorization Bypass |
|---|
| 説明 | Omega Solution Fulfillment by People 2025 contains an Insecure Direct Object Reference (IDOR) vulnerability in the user profile retrieval functionality. The application fails to enforce object-level authorization when processing requests to the user profile endpoint and directly trusts a user-controlled identifier to determine which profile record to return. An authenticated attacker can manipulate the user identifier in the request path to access profile information belonging to other users without authorization. Successful exploitation results in unauthorized disclosure of personally identifiable information (PII), including user names, email addresses, telephone numbers, postal addresses, account status, and role information, allowing enumeration of arbitrary user profiles and compromising data confidentiality.
Affected Component:
User Profile API
Affected Endpoint:
GET /user/{id}
Affected Parameter:
{id}
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization
OWASP Top 10 2021: A01 – Broken Access Control |
|---|
| ソース | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/23 |
|---|
| ユーザー | 4m3rr0r (UID 85795) |
|---|
| 送信 | 2026年07月17日 19:47 (2 月 ago) |
|---|
| モデレーション | 2026年09月20日 23:31 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 408066 [Omega Solution FBP Fulfillment by People 2025 User Profile API /user/ 識別子 特権昇格] |
|---|
| ポイント | 20 |
|---|