EUVD-2026-83864
GHSA-xfxp-2jm6-g29w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remotely reachable, unauthenticated API function missing an auth check (PR:N/AC:L), but disclosure is limited to role-permission data, so C:L and I:A both N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Missing authentication in the Role Permission API of Omega Solution HRM OS (versions up to 20260717) lets remote, unauthenticated attackers read role-permission data without a session or credential. Manipulating the roleId argument on the /role-permission/permission endpoint bypasses the intended access check entirely (CWE-306), and publicly available exploit code exists for this path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets a specific application function: the Role Permission API's /role-permission/permission endpoint in Omega Solution HRM OS versions up to 20260717, reached by manipulating the roleId argument. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, unauthenticated, low-complexity flaw, which superficially reads as easy to exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at the time of analysis, and the vendor did not respond to early notification, so no fixed HRM OS version can be cited and users cannot rely on an upgrade path yet. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper control of resource identifiers in Omega Solution HRM OS (versions up to 20260717) allows an authenticated low-
Cross-site scripting in Omega HRM OS up to 20260717 allows an authenticated attacker with high privileges and file-uploa
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today