OutSystems Lifetime versions before 11.28.2.3955 contain an authorization bypass flaw…
OutSystems Lifetime versions before 11.28.2.3955 contain an authorization bypass flaw allowing authenticated users to view change logs and application names across all applications.
CERT Polska coordinated disclosure of CVE-2026-40127, an authorization bypass vulnerability in OutSystems Lifetime software. The flaw exists in the ApplicationID parameter handling, allowing any authenticated user to exploit a user-controlled key to bypass authorization controls. Successful exploitation enables attackers to read change logs containing actions performed by other users and discover application names for any application in the environment, potentially exposing sensitive operational information and system architecture details.
The vulnerability affects OutSystems Lifetime versions prior to 11.28.2.3955, which contains the fix. OutSystems Lifetime is a unified console for managing application lifecycle across OutSystems environments, making this vulnerability particularly concerning for organizations using the platform for enterprise application development. The issue was responsibly disclosed by Zbigniew Piotrak of the AFINE Team and coordinated through CERT Polska's vulnerability disclosure process.
While the vulnerability requires authentication, the ability to view change logs and enumerate applications across the entire platform represents a significant information disclosure risk. Organizations using affected versions should prioritize upgrading to version 11.28.2.3955 or later to remediate this authorization control weakness.
Mentioned in this report
Detection guidance
Potential OutSystems Lifetime ApplicationID Authorization Bypass Enumeration
Detects repeated web requests to OutSystems Lifetime endpoints manipulating the ApplicationID parameter to access change logs or application details outside the requester's authorized scope, indicative of CVE-2026-40127 exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential OutSystems Lifetime ApplicationID Authorization Bypass Enumeration
id: fb3e289b-bd44-58e5-b8cd-3d3a3e37e6d0
status: experimental
description: 'Detects HTTP requests to OutSystems Lifetime application endpoints that
reference or manipulate the ApplicationID
parameter to retrieve change logs or application metadata. This pattern is consistent
with exploitation of
CVE-2026-40127, an authorization bypass allowing any authenticated user to enumerate
applications and read
change logs belonging to other users by supplying arbitrary ApplicationID values.
A single request is weak
evidence; a sustained series of requests from one authenticated session referencing
many distinct ApplicationID
values in a short window (e.g. dozens within minutes) is strong evidence of automated
enumeration and should be
correlated/thresholded in the SIEM rather than in this rule.
'
references:
- CVE-2026-40127
author: Vorant
tags:
- attack.t1087
- attack.discovery
- attack.t1078
logsource:
category: proxy
product: windows
detection:
selection:
c-uri|contains:
- /lifetime/
c-uri|contains|all:
- ApplicationID=
changelog_path:
c-uri|contains:
- changelog
- ChangeLog
- audit
filter_static_reference:
c-uri|contains:
- ApplicationID=00000000-0000-0000-0000-000000000000
condition: selection and changelog_path and not filter_static_reference
falsepositives:
- Legitimate administrators reviewing change logs for applications they are authorized
to manage
- Automated CI/CD or monitoring integrations that periodically poll Lifetime change
log APIs for multiple applications
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-40127
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free