Lifetime
Monthly
Authorization bypass in OutSystems Lifetime allows any authenticated platform user to read Change Logs for applications they are not authorized to access by manipulating the ApplicationID parameter - a classic IDOR exposing audit trails, user action histories, and application names across the management plane. All Lifetime versions prior to 11.28.2.3955 are affected, as confirmed by CERT-PL and the OutSystems vendor advisory. No public exploit code has been identified and EPSS exploitation probability is 0.04% (12th percentile), but the flaw is a meaningful control failure in environments that rely on role-segregated application visibility within Lifetime.
Authorization bypass in OutSystems Lifetime allows any authenticated platform user to read Change Logs for applications they are not authorized to access by manipulating the ApplicationID parameter - a classic IDOR exposing audit trails, user action histories, and application names across the management plane. All Lifetime versions prior to 11.28.2.3955 are affected, as confirmed by CERT-PL and the OutSystems vendor advisory. No public exploit code has been identified and EPSS exploitation probability is 0.04% (12th percentile), but the flaw is a meaningful control failure in environments that rely on role-segregated application visibility within Lifetime.