WEBCON BPS IDOR exposes employee vacation data
An IDOR flaw in WEBCON BPS lets authenticated users view other employees' vacation schedules; patched in 2025.2.1.177 and 2026.1.1.20.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-92419, an Insecure Direct Object Reference vulnerability in WEBCON BPS's /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API fails to verify whether the requesting user is authorized to view the data of the specified users. Any authenticated attacker can supply arbitrary user logins in this parameter to retrieve vacation schedules for other staff, including managers and employees at other offices, bypassing intended business-logic access restrictions.
The impact is limited to unauthorized disclosure of sensitive scheduling information rather than remote code execution or system compromise, but it could aid social engineering, reconnaissance, or privacy violations within an organization. There is no indication of active exploitation in the wild; this was a responsibly reported vulnerability coordinated through CERT Polska's CVD process, credited to researcher Robert Strzoda.
Defenders running WEBCON BPS should upgrade to the fixed versions 2025.2.1.177 or 2026.1.1.20 as soon as possible. Organizations unable to patch immediately should monitor API access logs for the /api/vacations/{path} endpoint for requests specifying selectedPeople values corresponding to users outside the requester's normal scope or reporting chain, which may indicate probing or abuse of this IDOR.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/09/CVE-2026-92419
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs