SIMAC MyPHR EUVD-2026-80933

Requires a valid authenticated MyPHR account (PR:L) with network access to the application's employee-update API; no user interaction and no special deployment mode are needed. The core precondition is the missing server-side ownership check on the PUT employee-update endpoint - any authenticated user can target any employee ID. Limiting factor: exploitation is gated on obtaining a low-privileged account, so exposure depends on how broadly accounts are provisioned (typically all employees in an HRIS) and whether the API is reachable from the attacker's network position.

This is a credible, actionable priority for any SIMAC MyPHR operator, driven more by exploit maturity than by exotic technique. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only a valid low-privileged application account - a realistic bar in an HR system where every employee holds credentials. Broken-object-authorization (IDOR/CWE-639) bugs are trivially reliable once found, and a public proof-of-concept exists (VulnCheck-referenced gist), so weaponization effort is near zero. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active in-the-wild exploitation - the risk is 'easy and public' rather than 'confirmed exploited.' The vendor's VC/VI/VA all-High (8.7) is defensible for confidentiality (PII, pay bulletins) and integrity (password overwrite = account takeover), but the availability-High is generous: the flaw is about unauthorized data access and modification, not service disruption, so I assess availability as none-to-low. Note the 'Authentication Bypass' tag conflicts with the vector - PR:L means the attacker is already authenticated; this is an authorization (ownership-validation) failure, not authentication bypass.

A low-privileged employee (or anyone who can register/obtain a MyPHR account) authenticates, then sends a PUT to the employee-update API endpoint substituting another employee's identifier and a chosen password value. Because the server never verifies that the caller owns the target record, the attacker overwrites the victim's password, takes over the account, and reads sensitive PII including private pay bulletins; iterating the ID enumerates the entire workforce. A public PoC gist is referenced, so the technique is documented and immediately reusable.