WEBCON BPS CVE-2026-92419

Requires an authenticated WEBCON BPS account (PR:L) with network access to the application's REST API; the specific trigger is the /api/vacations/{path} Gantt vacation-chart endpoint accepting an attacker-controlled selectedPeople parameter that is not authorization-checked. No user interaction, admin rights, or non-default configuration is needed - any valid login can enumerate other users' logins in the parameter. The limiting factor is that the attacker must already hold valid credentials, and impact is confined to disclosure of vacation/scheduling data (no write access or system compromise). Fixed in 2025.2.1.177 and 2026.1.1.20.

This is a genuine but low-severity information-disclosure flaw, not a top-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L, base 5.3) is internally consistent with the description: network-reachable API, low complexity, requires an authenticated low-privilege account, and yields only limited confidentiality impact (VI:N/VA:N) - the attacker can read others' vacation schedules but cannot modify data or affect availability. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so all real-world-exploitation signals are absent or unknown. The mislabeling of the CWE-639 IDOR as 'Authentication Bypass' in the tags is inaccurate - authentication is required (PR:L) and is not bypassed; only object-level authorization is missing. Net priority: low-to-moderate; the primary risk is unauthorized disclosure of employee scheduling/HR-adjacent data by an insider or any account holder, which is a privacy concern rather than a system-compromise threat.

An authenticated WEBCON BPS user (e.g., a regular employee) sends a request to the /api/vacations/{path} Gantt endpoint and substitutes arbitrary user logins into the selectedPeople parameter. Because the API never checks whether the requester is authorized to view those users, it returns the vacation schedules of managers and staff in other offices, bypassing business-logic access restrictions. No public exploit code was identified, but the attack is trivial to reproduce by tampering with a legitimate API request.