Insecure direct object reference (IDOR) vulnerability in Fullstep
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
An insecure direct object reference (IDOR) vulnerability in the Fullstep V5 registration process allows authenticated users to access data belonging to other registered users through various vulnerable authenticated resources in the application. The vulnerable endpoints result from: '/api/suppliers/v1/suppliers//false' to list user information; and '/#/supplier-registration/supplier-registration//2' to update your user information (personal details, documents, etc.).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Fullstep (Fullstep) Fixed in 5.30.07
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5750
- 2026-10-03 Alias added: GHSA-27hq-xp89-25mq
References
More Fullstep vulnerabilities
- TI-2026-05040 Inadequate access control vulnerability in Fullstep CVSS 4.0HIGH 8.7
Sources
- CVE-2026-5750 · CVE Program
- CVE-2026-5750 · NVD
- FIRST EPSS
- GHSA-27hq-xp89-25mq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences