CVE-2026-79957: ServiceNext Insecure Direct Object Reference via GetUsarios
ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated ServiceNext user can exploit it. The attacker only needs a valid token and can supply different numeric user IDs to access other users' profile records.
What information may be exposed, and what is the likely impact?
The endpoint can disclose full user profile records, including passwords stored in cleartext. Exposed credentials could enable account takeover and credential-stuffing attempts against other services where users reused passwords.
Is user interaction required for exploitation?
No. Exploitation does not require interaction from another user; an authenticated attacker can directly send requests to the affected endpoint.
How can defenders determine whether the issue is being abused?
Review requests to /api/Usuario/GetUsuarios for authenticated sessions submitting multiple or sequential numeric IDs, particularly IDs that do not belong to the token's account. Investigate responses that returned profile records for accounts other than the requesting user.