EUVD-2026-83866
GHSA-r976-2rf7-fgwv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitEnumerate/guess other user ID values
-
ExecutionManipulate ID argument on /user/ API
-
ImpactRetrieve unauthorized profile data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated low-privilege account on the target FBP Fulfillment by People instance (CVSS PR:L); the attacker then manipulates the user-controlled ID argument against the /user/ User Profile API endpoint to reference resources they do not own. Exploitation is limited by the need for valid credentials and by the impact ceiling of confidentiality-only disclosure (VC:L, no integrity or availability effect) - an attacker can read another user's profile data but cannot modify it or disrupt service through this flaw. No user interaction is required (UI:N). |
| Impact | This is a CWE-639 insecure-direct-object-reference (authorization bypass) in the User Profile API of an obscure product, and the real-world risk is modest despite the network vector. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) correctly caps impact at confidentiality-only (VC:L) with no integrity or availability effect, and requires PR:L - an already-authenticated low-privilege user manipulating the ID argument to view another user's profile data. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided; the only elevated signal is that public exploit code exists (E:P, plus a GitHub PoC), which raises accessibility but does NOT equal active exploitation. The two signals should not be conflated: PoC availability is confirmed, active exploitation is not. Net: this is a genuine but low-severity authorization flaw, not a high-priority emergency - a mid-single-digit CVSS issue whose practical risk is bounded by requiring valid authentication and by leaking only limited profile data. |
| Exploit ScenarioDerived | An authenticated low-privilege user of an FBP Fulfillment by People deployment sends a request to the /user/ endpoint and substitutes another user's identifier in the ID parameter, causing the User Profile API to return profile data belonging to that other account without an ownership check. Publicly available exploit code (referenced via VulDB and a GitHub PoC issue) demonstrates the manipulation, lowering the skill barrier for reuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Authorization bypass in Omega Solution FBP Fulfillment by People 2025 allows authenticated low-privilege users to read other users' profile data via the /user/ User Profile API endpoint by manipulating the ID argument. This is a CWE-639 insecure direct object reference, requiring a valid low-privilege account but no user interaction, and results in confidentiality-only disclosure (no integrity or availability impact). Publicly available exploit code exists and the vendor was contacted early but did not respond; there is no CISA KEV listing, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
RemediationAI
No vendor-released patch identified at time of analysis; the vendor was contacted early but did not respond, so there is no official advisory or fixed version to cite. In the absence of a patch, implement server-side authorization checks on the /user/ endpoint so that the authenticated user's identity is compared against the owner of the requested profile ID before any data is returned; do not rely on client-supplied IDs for access control. Alternatively, replace direct object references with indirect reference maps or random tokens. As a temporary compensating control, restrict access to the User Profile API to trusted networks or IP ranges, or add a WAF rule that blocks requests where the ID parameter does not match the authenticated session's user ID, but note that such rules can break legitimate functionality if not carefully tuned. Monitor logs for abnormal access patterns to the /user/ endpoint. Because public exploit code exists (https://github.com/4m3rr0r/PoCVulDb/issues/23), prioritize these mitigations.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an insecure direct object reference (IDOR) matching CWE-639 (Authorization Bypass Through User-Controlled Key) in the /user/ endpoint of the User Profile API component. An authenticated attacker with a low-privilege account can supply an arbitrary ID value to access profile records belonging to other users because the application fails to verify that the authenticated principal owns the requested object. The affected product is Omega Solution FBP Fulfillment by People 2025, identified by CPE cpe:2.3:a:omega_solution:fbp_fulfillment_by_people:*:*:*:*:*:*:*:* indicating all versions are potentially vulnerable. The reporter's CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P, which aligns with the independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. No vendor patch or advisory is available, and the vendor did not respond to the disclosure.
Know when Fbp Fulfillment By People gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Authenticated low-priv user (PR:L) remotely manipulates an ID over the network (AV:N/AC:L) to read another user's profile, yielding limited confidentiality only (C:L, I/A:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB