CVE-2026-47094: SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}
SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary employee identifier and a controlled password value to take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information including private pay bulletins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the missing server-side ownership validation by ensuring the authenticated user is authorized to modify the employee record identified by {id} before allowing PUT operations (prevents IDOR).
SIMAC MyPHR Server-side ownership validation for /api/employes/put/{id} = enabled - Compensating control
Restrict access to the SIMAC MyPHR employee update endpoint (/api/employes/put/{id}) so that authenticated users can only reach resources they are authorized to own; enforce this at the server with proper authorization/ownership checks for the employee identifier in the path (mitigates IDOR leading to account takeover and sensitive record access).
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated with a valid account. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What can an attacker do after exploiting the issue?
An authenticated attacker can modify arbitrary employee records, including setting a controlled password to take over another employee account. They can also enumerate employee records and access sensitive PII, including private pay bulletins.
What request behavior enables account takeover?
The issue is triggered by sending a PUT request to /api/employes/put/{id} with an arbitrary employee identifier and a controlled password value. The endpoint lacks server-side validation that the requester owns the targeted employee record.