Read the docs
TI-2026-62331 Aliases CVE-2026-92419GHSA-q2c4-mww2-9fhw

IDOR in WEBCON BPS

Priority LOW 24CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply arbitrary user logins in the selectedPeople parameter to view vacation schedules of other employees, including managers and staff from other offices, regardless of business logic access restrictions, resulting in unauthorized disclosure of sensitive scheduling information.This vulnerability was fixed in versions: 2025.2.1.177 and 2026.1.1.20

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Fixed WEBCON BPS (WEBCON): 2025.2.1.177, 2026.1.1.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WEBCONWEBCON BPS2024.1.1.145 to before 2025.2.1.177; 2026.1.1.1 to before 2026.1.1.202025.2.1.177, 2026.1.1.20Patch availableCNA
  • WEBCON BPS VendorWEBCON Affected 2024.1.1.145 to before 2025.2.1.177; 2026.1.1.1 to before 2026.1.1.20 Fixed in 2025.2.1.177, 2026.1.1.20 Patch available CNA

Remediation

  • Fix · CNA WEBCON BPS (WEBCON) Fixed in 2025.2.1.177, 2026.1.1.20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-92419
  2. 2026-10-03 Alias added: GHSA-q2c4-mww2-9fhw

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences