CVE-2026-79957

Deferred Deferred - Pending Action

Insecure Direct Object Reference (IDOR) in ServiceNext User Data Exposure

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Black Lantern Security

Description

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-79957

EUVD

EUVD-2026-101517

Affected Vendors & Products

Vendor	Product	Version / Range
ServiceNext	SerTec	1.00

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-79957 is an Insecure Direct Object Reference (IDOR) vulnerability in ServiceNext's platform. It exists in the /api/Usuario/GetUsuarios endpoint where user-controlled numeric IDs in the request body are not properly validated against the authenticated token. This allows any authenticated user to manipulate IDs to access other users' full profile records, including cleartext passwords.

Detection Guidance

To detect this IDOR vulnerability, monitor API traffic for requests to /api/Usuario/GetUsuarios with sequential numeric IDs in the request body. Use tools like Burp Suite or OWASP ZAP to intercept and modify requests, testing if different IDs return unauthorized user data. Check server logs for repeated access attempts to this endpoint with varying IDs.

Impact Analysis

An attacker could exploit this to retrieve all user profiles, including passwords, enabling account takeover and credential-stuffing attacks. Since user IDs are sequential, attackers can enumerate every account in the system, leading to large-scale credential theft and exposure of sensitive business data like partner associations.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if health-related data is exposed. It results in non-compliance with data protection requirements for confidentiality, integrity, and access controls, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately apply the latest patch from ServiceNext to add proper authorization checks. Disable the /api/Usuario/GetUsuarios endpoint if not critical. Implement rate limiting and input validation to prevent ID enumeration. Rotate all user passwords stored in cleartext and enforce multi-factor authentication.

Hi! I’m here to help you understand CVE-2026-79957. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70