CVE-2026-79957: ServiceNext Insecure Direct Object Reference via GetUsarios

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-16
Weakness: CWE-639

Description

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

Affected products

ServiceNext SerTec: 1.00

References

https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object
https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object

Get alerted when CVE-2026-79957 or the next vulnerability affects your stack