| 标题 | Omega Solution Fulfillment by People 2025 (latest) Authorization Bypass |
|---|
| 描述 | Omega Solution Fulfillment by People 2025 contains an Insecure Direct Object Reference (IDOR) vulnerability in the user profile retrieval functionality. The application fails to enforce object-level authorization when processing requests to the user profile endpoint and directly trusts a user-controlled identifier to determine which profile record to return. An authenticated attacker can manipulate the user identifier in the request path to access profile information belonging to other users without authorization. Successful exploitation results in unauthorized disclosure of personally identifiable information (PII), including user names, email addresses, telephone numbers, postal addresses, account status, and role information, allowing enumeration of arbitrary user profiles and compromising data confidentiality.
Affected Component:
User Profile API
Affected Endpoint:
GET /user/{id}
Affected Parameter:
{id}
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization
OWASP Top 10 2021: A01 – Broken Access Control |
|---|
| 来源 | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/23 |
|---|
| 用户 | 4m3rr0r (UID 85795) |
|---|
| 提交 | 2026-07-17 19時47分 (2 月前) |
|---|
| 管理 | 2026-09-20 23時31分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 408066 [Omega Solution FBP Fulfillment by People 2025 User Profile API /user/ 标识符 权限提升] |
|---|
| 积分 | 20 |
|---|