CVE-2026-40127CWE-639

CVE-2026-40127

published May 25, 2026

CVSS
5.3
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter. Any authenticated user, can read the Change Log containing actions performed by other users as well as application name of any application.

This issue was fixed in OutSystems Lifetime version 11.28.2.3955

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00599 · 48.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-25T15:16Z
References (3)
https://cert.pl/en/posts/2026/05/CVE-2026-40126/ · [email protected]https://success.outsystems.com/support/security/vulnerabilities/vulnerability_rpm_6441/ · [email protected]https://www.outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=11&ComponentName=LifeTime · [email protected]
EPSS history
Timeline
  • 25 MAY 10:18Z
    Authorization Bypass Through User-Controlled Key in OutSystems Lifetime
    cvelistv5