Fbp Fulfillment By People
Monthly
Authorization bypass in Omega Solution FBP Fulfillment by People 2025 allows authenticated low-privilege users to read other users' profile data via the /user/ User Profile API endpoint by manipulating the ID argument. This is a CWE-639 insecure direct object reference, requiring a valid low-privilege account but no user interaction, and results in confidentiality-only disclosure (no integrity or availability impact). Publicly available exploit code exists and the vendor was contacted early but did not respond; there is no CISA KEV listing, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Authorization bypass in Omega Solution FBP Fulfillment by People 2025 allows authenticated low-privilege users to read other users' profile data via the /user/ User Profile API endpoint by manipulating the ID argument. This is a CWE-639 insecure direct object reference, requiring a valid low-privilege account but no user interaction, and results in confidentiality-only disclosure (no integrity or availability impact). Publicly available exploit code exists and the vendor was contacted early but did not respond; there is no CISA KEV listing, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.