EUVD-2026-31662
GHSA-jrw3-h5q4-rwxc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint exploitable by any authenticated Lifetime user; limited to low confidentiality impact on audit logs with no integrity, availability, or scope-change effect.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter. Any authenticated user, can read the Change Log containing actions performed by other users as well as application name of any application.
This issue was fixed in OutSystems Lifetime version 11.28.2.3955
AnalysisAI
Authorization bypass in OutSystems Lifetime allows any authenticated platform user to read Change Logs for applications they are not authorized to access by manipulating the ApplicationID parameter - a classic IDOR exposing audit trails, user action histories, and application names across the management plane. All Lifetime versions prior to 11.28.2.3955 are affected, as confirmed by CERT-PL and the OutSystems vendor advisory. No public exploit code has been identified and EPSS exploitation probability is 0.04% (12th percentile), but the flaw is a meaningful control failure in environments that rely on role-segregated application visibility within Lifetime.
Technical ContextAI
OutSystems Lifetime is the centralized IT management console for the OutSystems low-code platform, governing application lifecycle management, deployments, team access, and audit logging across development, test, and production environments. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), a variant of Insecure Direct Object Reference (IDOR): the endpoint returning application Change Logs accepts a client-supplied ApplicationID parameter without verifying whether the authenticated requester holds authorization to view that specific application's audit history. The server returns data based solely on the key value rather than enforcing the caller's permission scope. CPE data (cpe:2.3:a:outsystems:lifetime:*:*:*:*:*:*:*:*) confirms all Lifetime versions are affected up to the fix release. No cryptographic or session-layer weakness is involved - the root cause is purely a missing server-side authorization check on a direct object reference.
RemediationAI
Upgrade OutSystems Lifetime to version 11.28.2.3955 or later, which contains the vendor-confirmed fix for this authorization bypass as documented at https://www.outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=11&ComponentName=LifeTime. If immediate patching is operationally constrained, reduce the exposure window by restricting Lifetime console access to only those users and roles that require cross-application visibility, shrinking the population capable of abusing the flaw - note that this does not eliminate the vulnerability but limits its blast radius. As a detection measure, review existing Lifetime Change Log access patterns to identify requests where a user's ApplicationID parameter values span applications outside their authorized scope, which would indicate prior exploitation. No workaround fully substitutes for the patch.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today