Authorization Bypass Through User-Controlled Key in OutSystems Lifetime
Priority LOW 25CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter. Any authenticated user, can read the Change Log containing actions performed by other users as well as application name of any application. This issue was fixed in OutSystems Lifetime version 11.28.2.3955
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00495 42nd percentileScored 2026-11-07
Fix Fixed Lifetime (OutSystems): 11.28.2.3955
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OutSystems | Lifetime | before 11.28.2.3955 | 11.28.2.3955 | Patch available | CNA |
- Lifetime VendorOutSystems Affected before 11.28.2.3955 Fixed in 11.28.2.3955 Patch available CNA
Remediation
- Fix · CNA Lifetime (OutSystems) Fixed in 11.28.2.3955
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40127
- 2026-10-03 Alias added: GHSA-jrw3-h5q4-rwxc
References
More OutSystems vulnerabilities
- TI-2022-23664 A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11… CVSS 3.1HIGH 7.8
- TI-2025-37969 Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service… CVSS 3.1HIGH 7.5
- TI-2021-10104 The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11… CVSS 3.1HIGH 8.6
- TI-2020-17678 An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. CVSS 3.1HIGH 7.2
- TI-2020-10701 A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before… CVSS 3.1MEDIUM 6.1
- TI-2019-09159 OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-40127 · CVE Program
- CVE-2026-40127 · NVD
- FIRST EPSS
- GHSA-jrw3-h5q4-rwxc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences