CVE-2026-94152CWE-285CWE-639

CVE-2026-94152

Medium · published September 21, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00374 · 30.2th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-21T13:17Z
References (5)
https://github.com/4m3rr0r/PoCVulDb/issues/23 · [email protected]https://vuldb.com/cve/CVE-2026-94152 · [email protected]https://vuldb.com/submit/894314 · [email protected]https://vuldb.com/vuln/408066 · [email protected]https://vuldb.com/vuln/408066/cti · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 21 SEP 08:30Z
    Omega Solution FBP Fulfillment by People User Profile API user authorization
    cvelistv5