CVE-2026-92419
Deferred Deferred - Pending Action

WEBCON BPS IDOR Vulnerability in Vacation API

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: CERT.PL

Description
WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply arbitrary user logins in the selectedPeople parameter to view vacation schedules of other employees, including managers and staff from other offices, regardless of business logic access restrictions, resulting in unauthorized disclosure of sensitive scheduling information.This vulnerability was fixed in versions: 2025.2.1.177 and 2026.1.1.20

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-92419
EUVD
EUVD-2026-85339

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
webcon bps 2025.2.1.177
webcon bps 2026.1.1.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in WEBCON BPS software. It affects the /api/vacations/{path} endpoint, specifically the selectedPeople parameter in the Gantt vacation chart API. An authenticated attacker can manipulate this parameter to supply arbitrary user logins and access sensitive vacation schedules of other employees without proper authorization checks.

Detection Guidance

To detect this vulnerability, check if your WEBCON BPS instance has the /api/vacations/{path} endpoint exposed. Use tools like curl to test the selectedPeople parameter with different user logins and verify if unauthorized vacation schedules are returned. Example: curl -X GET 'https://your-bps-server/api/vacations/{path}?selectedPeople=target_user_login'

Ensure the server responds with sensitive data when arbitrary user logins are provided, indicating potential IDOR exposure.

Impact Analysis

An attacker could exploit this to view vacation schedules of employees, including managers and staff from other offices. This leads to unauthorized disclosure of sensitive scheduling information, potentially exposing personal data and internal business operations.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by enabling unauthorized access to personal data. It violates principles of data minimization and access control, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Immediately update WEBCON BPS to version 2025.2.1.177 or 2026.1.1.20 or later to patch the IDOR vulnerability in the /api/vacations/{path} endpoint.

If immediate patching is not possible, restrict access to the /api/vacations/{path} endpoint via network controls or disable the Gantt vacation chart feature temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92419. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart