CVE-2026-79957CWE-639

CVE-2026-79957

High · published October 14, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00266 · 17.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-14T22:18Z
References (2)
https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object · [email protected]https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 14 OCT 18:01Z
    ServiceNext Insecure Direct Object Reference via GetUsarios
    cvelistv5
  • 14 OCT 18:01Z
    ServiceNext Insecure Direct Object Reference via GetUsarios
    cvelistv5