CVE-2025-41096CWE-639

Insecure Direct Object Reference in GPS BOLD Workplanner

High · published September 30, 2025

CVSS v4.0
7.1
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the dates of the current contract details using unauthorised internal identifiers.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00256 · 16.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-09-30T11:16Z
EPSS history
Timeline
  • 30 SEP 11:16Z
    Insecure Direct Object Reference in GPS BOLD Workplanner
    cvelistv5