EUVD-2026-80933
GHSA-7x6f-hv5j-6c4j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv user (PR:L) exploits a network API with no interaction; full read of PII (C:H) and password-overwrite account takeover (I:H); no service disruption so A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary employee identifier and a controlled password value to take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information including private pay bulletins.
AnalysisAI
SIMAC MyPHR 1.1 exposes an insecure direct object reference (IDOR) in its employee-update API that lets any authenticated user with a valid low-privileged account access and modify arbitrary employee records. By sending a PUT request with another employee's identifier and a controlled password value, an attacker can take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information such as private pay bulletins. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated MyPHR account (PR:L) with network access to the application's employee-update API; no user interaction and no special deployment mode are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible, actionable priority for any SIMAC MyPHR operator, driven more by exploit maturity than by exotic technique. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, isolate SIMAC MyPHR 1.1 from untrusted networks, restrict API access to authorized IP ranges, enable MFA for all MyPHR accounts, and review logs for anomalous PUT requests to the employee-update API. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today