CVE-2026-94151: Omega Solution HRM OS Role Permission API permission missing authentication

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-21 · updated 2026-09-21
Weakness: CWE-287

Description

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Omega Solution HRM OS: 20260717

References

https://github.com/4m3rr0r/PoCVulDb/issues/22
https://vuldb.com/cve/CVE-2026-94151
https://vuldb.com/submit/894312
https://vuldb.com/vuln/408065
https://vuldb.com/vuln/408065/cti

Get alerted when CVE-2026-94151 or the next vulnerability affects your stack