Information Disclosure in Vedo Suite

Executive Summary

CVE-2026-51367 is an Insecure Direct Object Reference (IDOR) vulnerability in Bottinelli Informatica Vedo Suite v1.2.5. It allows authenticated low-privileged users to access unauthorized data by manipulating parameters in API requests, specifically the utente_chat parameter in the /api_vedo/chat endpoint. The flaw stems from missing server-side validation, enabling attackers to retrieve sensitive information belonging to other users.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-51367, monitor API requests to the affected endpoints (/api_vedo/dati-ftp and /api_vedo/chat) for unusual parameter manipulation. Check for requests where utente_ftp or utente_chat parameters are modified to reference other users' identifiers. Use network traffic analysis tools like Wireshark or tcpdump to inspect HTTP POST/GET requests for these patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data, including private FTP information and chat communications of other users. Attackers with a low-privilege account can exploit it to bypass authorization checks and retrieve confidential information, resulting in high confidentiality impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR and HIPAA due to unauthorized data exposure. GDPR mandates strict data protection and user consent, while HIPAA requires safeguards for protected health information. The breach of confidentiality could lead to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply vendor patches for Vedo Suite v1.2.5. Implement server-side authorization checks to validate user ownership of requested data. Deploy a Web Application Firewall (WAF) to block malicious parameter manipulation. Restrict access to the vulnerable endpoints until patches are applied. Review user accounts to ensure no unauthorized access has occurred.

Useful 0 Not Useful 0