OutSystems Lifetime authorization bypass exposes application data
OutSystems Lifetime versions before 11.28.2.3955 contain an authorization bypass flaw allowing authenticated users to view change logs and application names across all applications.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-40127, an authorization bypass vulnerability in OutSystems Lifetime software. The flaw exists in the ApplicationID parameter handling, allowing any authenticated user to exploit a user-controlled key to bypass authorization controls. Successful exploitation enables attackers to read change logs containing actions performed by other users and discover application names for any application in the environment, potentially exposing sensitive operational information and system architecture details.
The vulnerability affects OutSystems Lifetime versions prior to 11.28.2.3955, which contains the fix. OutSystems Lifetime is a unified console for managing application lifecycle across OutSystems environments, making this vulnerability particularly concerning for organizations using the platform for enterprise application development. The issue was responsibly disclosed by Zbigniew Piotrak of the AFINE Team and coordinated through CERT Polska's vulnerability disclosure process.
While the vulnerability requires authentication, the ability to view change logs and enumerate applications across the entire platform represents a significant information disclosure risk. Organizations using affected versions should prioritize upgrading to version 11.28.2.3955 or later to remediate this authorization control weakness.
Mentioned in this report
Detection guidance
Potential OutSystems Lifetime ApplicationID Authorization Bypass Enumeration
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects repeated web requests to OutSystems Lifetime endpoints manipulating the ApplicationID parameter to access change logs or application details outside the requester's authorized scope, indicative of CVE-2026-40127 exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential OutSystems Lifetime ApplicationID Authorization Bypass Enumeration
id: fb3e289b-bd44-58e5-b8cd-3d3a3e37e6d0
status: experimental
description: 'Detects HTTP requests to OutSystems Lifetime application endpoints that
reference or manipulate the ApplicationID
parameter to retrieve change logs or application metadata. This pattern is consistent
with exploitation of
CVE-2026-40127, an authorization bypass allowing any authenticated user to enumerate
applications and read
change logs belonging to other users by supplying arbitrary ApplicationID values.
A single request is weak
evidence; a sustained series of requests from one authenticated session referencing
many distinct ApplicationID
values in a short window (e.g. dozens within minutes) is strong evidence of automated
enumeration and should be
correlated/thresholded in the SIEM rather than in this rule.
'
references:
- CVE-2026-40127
author: Vorant
tags:
- attack.t1087
- attack.discovery
- attack.t1078
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- /lifetime/
c-uri|contains|all:
- ApplicationID=
changelog_path:
c-uri|contains:
- changelog
- ChangeLog
- audit
filter_static_reference:
c-uri|contains:
- ApplicationID=00000000-0000-0000-0000-000000000000
condition: selection and changelog_path and not filter_static_reference
falsepositives:
- Legitimate administrators reviewing change logs for applications they are authorized
to manage
- Automated CI/CD or monitoring integrations that periodically poll Lifetime change
log APIs for multiple applications
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-40127
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs