CVE-2026-47094CWE-639

CVE-2026-47094

High · published September 16, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary employee identifier and a controlled password value to take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information including private pay bulletins.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00506 · 42.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-16T22:17Z
References (3)
https://gist.github.com/LnPaulin/33e9b08ef0e26198afbfcc1343850682 · [email protected]https://it.simac.tn/nos-solutions/logiciel-de-gestion-des-ressources-humaines/ · [email protected]https://www.vulncheck.com/advisories/simac-myphr-idor-account-takeover-via-api-employes-put-id · [email protected]
EPSS history
Timeline
  • 18 SEP 03:59Z
    EPSS moved — → 0%
    epss
  • 16 SEP 17:39Z
    SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}
    cvelistv5