CVE-2026-79957
8.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-639
Impact
Authenticated users can access full profile records of every user, including cleartext passwords, leading to total account takeover. An attacker only needs basic network access and a valid low-privileged account.
Root cause
The /api/Usuario/GetUsuarios endpoint accepts an arbitrary user ID without verifying that the requesting user's authorization token owns that account.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
No fixed version is specified in the advisory; block external access to the /api/Usuario/GetUsuarios endpoint or restrict it via WAF/reverse proxy while awaiting a vendor patch.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.