Full Report
Authorization bypass through User-Controlled key vulnerability (CVE-2026-92419) has been found in WEBCON BPS software.
Analysis Summary
# Vulnerability: WEBCON BPS Authorization Bypass (IDOR)
## CVE Details
- **CVE ID**: CVE-2026-92419
- **CVSS Score**: Not explicitly provided in the source (Estimate: Medium/High due to unauthorized data disclosure)
- **CWE**: CWE-639: Authorization Bypass Through User-Controlled Key (Insecure Direct Object Reference - IDOR)
## Affected Systems
- **Products**: WEBCON BPS
- **Versions**:
- From 2024.1.1.145 before 2025.2.1.177
- From 2026.1.1.1 before 2026.1.1.20
- **Configurations**: Systems utilizing the Gantt vacation chart API functionality.
## Vulnerability Description
WEBCON BPS suffers from an Insecure Direct Object Reference (IDOR) vulnerability within the `/api/vacations/{path}` endpoint. The flaw exists specifically in the `selectedPeople` parameter of the Gantt vacation chart API. The application fails to validate if the authenticated user making the request has the necessary permissions to view the data of the users specified in the parameter.
## Exploitation
- **Status**: Reported via Coordinated Vulnerability Disclosure (CVD); no active exploitation in the wild reported.
- **Complexity**: Low (Requires simple manipulation of an API parameter).
- **Attack Vector**: Network (Requires authentication).
## Impact
- **Confidentiality**: High (Unauthorized disclosure of sensitive employee scheduling, management activity, and staffing information across different offices).
- **Integrity**: None (Read-only access to scheduling data).
- **Availability**: None.
## Remediation
### Patches
The vendor has released security updates to address this flaw. Users should upgrade to the following versions or later:
- **2025.2.1.177**
- **2026.1.1.20**
### Workarounds
No specific workarounds were provided. The primary recommendation is to apply the software updates immediately to rectify the authorization logic.
## Detection
- **Indicators of Compromise**: Review web server logs for unusual or repetitive requests to the `/api/vacations/` endpoint, particularly those involving high volumes of different user logins in the `selectedPeople` parameter.
- **Detection methods**: Monitor for authenticated users accessing scheduling data for personnel outside their organizational scope or business unit.
## References
- **CERT Polska Advisory**: hxxps://cert[.]pl/en/posts/2026/09/CVE-2026-92419/
- **CVE Record**: hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-92419
- **CWE-639 Definition**: hxxps://cwe[.]mitre[.]org/data/definitions/639[.]html