HIGH 8.1 NVD

CVE-2026-79957

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the requ

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

References

https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object

Published: 2026-10-14 · Source: NVD · Feed updated: 2026-10-14

This high severity vulnerability with a CVSS score of 8.1 was published on 2026-10-14 via NVD.

vulnfeed aggregates 15189 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.