CVE-2026-94149: Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection
A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource identifiers. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates low privileges are required (PR:L). The attack can be performed remotely and does not require user interaction.
What systems should be prioritized for investigation?
Prioritize Omega Solution HRM OS instances up to version 20260717 that expose the /role-permission/permission endpoint. The affected component is the Role Permission Retrieval Endpoint and the manipulated parameter is roleId.
Is exploitation likely to be practical?
A public exploit is available, and the exploit maturity metric is rated proof-of-concept (E:P). This makes exposed, reachable instances more important to assess promptly.
What is the expected impact?
The reported CVSS vector rates confidentiality impact as low, with no integrity or availability impact. The issue is improper control of resource identifiers, which may allow access to permission resources associated with manipulated roleId values.