CVE-2026-92419

WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...

CVE-2026-92419 IDOR in WEBCON BPS

WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...

EUVD-2026-85339

WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...

CVE-2026-92419 IDOR in WEBCON BPS

WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...

CVE-2026-92419: Authorization Bypass Through User-Controlled Key

WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...