CVE-2026-94152
Received Received - Intake

Authorization Bypass in Omega Solution FBP Fulfillment by People

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94152
EUVD
EUVD-2026-83866

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
omega_solution fbp_fulfillment 2025

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Omega Solution FBP Fulfillment by People 2025. It affects the User Profile API where the ID argument in the /user/ endpoint can be manipulated to access unauthorized user data. The flaw allows remote attackers to view private profile information of other users without proper permissions.

Detection Guidance

To detect this vulnerability, test the GET /user/{id} endpoint by sending requests with different user IDs while authenticated. If the application returns profile data for unauthorized IDs, the vulnerability exists. Use tools like curl to automate testing: curl -H 'Authorization: Bearer <token>' http://target/user/123. Compare responses for valid vs invalid IDs.

Impact Analysis

An attacker could exploit this to access your personal data such as name, email, phone number, address, and account status. This stolen information may be used for phishing or social engineering attacks against you or others.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and insufficient protection measures. It may also breach HIPAA if protected health information is exposed through the compromised user profiles.

Mitigation Strategies

Implement server-side authorization checks to verify the authenticated user's JWT subject matches the requested user ID. Return 403 Forbidden or 401 Unauthorized for unauthorized access attempts. Ensure all profile data access is restricted to the owner or authorized roles only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94152. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart