CVE-2026-79957

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

CVE-2026-79957

The ServiceNext application contains an Insecure Direct Object Reference (IDOR) vulnerability within the /api/Usuario/GetUsuarios endpoint. The flaw occurs because the application accepts a user-controlled numeric ID in the request body but fails to verify if the authenticated token belongs to th...

CVE-2026-79957 ServiceNext Insecure Direct Object Reference via GetUsarios

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

EUVD-2026-101517

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...