CVE-2026-92419

WEBCON BPS is affected by an Insecure Direct Object Reference (IDOR) vulnerability within the /api/vacations/{path} endpoint. The root cause is a failure to validate user authorization for the selectedPeople parameter in the Gantt vacation chart API . This allows an authenticated attacker to prov...

PT-2026-97344

Name of the Vulnerable Software and Affected Versions WEBCON BPS versions prior to 2025.2.1.177 WEBCON BPS versions prior to 2026.1.1.20 Description An Insecure Direct Object Reference IDOR exists in the '/api/vacations/path' endpoint. The Gantt vacation chart API fails to validate if the...