7 matches found
CVE-2026-92419
WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...
EUVD-2026-85339
WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...
CVE-2026-92419 IDOR in WEBCON BPS
WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...
CVE-2026-92419 IDOR in WEBCON BPS
WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...
CVE-2026-92419
WEBCON BPS is affected by an Insecure Direct Object Reference (IDOR) vulnerability within the /api/vacations/{path} endpoint. The root cause is a failure to validate user authorization for the selectedPeople parameter in the Gantt vacation chart API . This allows an authenticated attacker to prov...
CVE-2026-92419: Authorization Bypass Through User-Controlled Key
WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...
PT-2026-97344
Name of the Vulnerable Software and Affected Versions WEBCON BPS versions prior to 2025.2.1.177 WEBCON BPS versions prior to 2026.1.1.20 Description An Insecure Direct Object Reference IDOR exists in the '/api/vacations/path' endpoint. The Gantt vacation chart API fails to validate if the...