CVE-2026-94151CWE-287CWE-306

CVE-2026-94151

Medium · published September 21, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00675 · 51.6th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-09-21T13:17Z
References (5)
https://github.com/4m3rr0r/PoCVulDb/issues/22 · [email protected]https://vuldb.com/cve/CVE-2026-94151 · [email protected]https://vuldb.com/submit/894312 · [email protected]https://vuldb.com/vuln/408065 · [email protected]https://vuldb.com/vuln/408065/cti · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 21 SEP 08:15Z
    Omega Solution HRM OS Role Permission API permission missing authentication
    cvelistv5