CVE-2026-94149
Received Received - Intake

Improper Resource Control in Omega Solution HRM OS via Role Permission Retrieval

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description
A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource identifiers. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94149
EUVD
EUVD-2026-83859

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
omega_solution hrm_os to 20260717 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-99 The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in Omega Solution HRM OS. It affects the role permission retrieval endpoint where the roleId parameter is trusted without proper authorization checks. An attacker can manipulate this parameter to access permission data of higher-privileged roles, such as the Administrator role, by changing the roleId value.

Detection Guidance

Check for unauthorized access to role permissions by testing the GET /role-permission/permission?roleId=<id> endpoint. Use tools like curl to send requests with different roleId values and verify if lower-privileged users can access higher-privileged data. Example: curl -u user:password 'http://target.com/role-permission/permission?roleId=1' and compare responses for roleId=6.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive role configurations and permissions, potentially leading to privilege escalation. Even though backend routes may block direct administrative actions, the frontend could still display administrative elements, revealing internal authorization structures.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of role configurations and permissions may result in non-compliance with data protection regulations, potentially leading to legal and financial penalties.

Mitigation Strategies

Implement server-side authorization checks to validate roleId against the user's permissions before returning data. Ensure object-level access controls are enforced to prevent unauthorized role permission retrieval. Update the application to verify user privileges before processing roleId requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94149. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart