CVE-2025-41091 Overview
CVE-2025-41091 is an Insecure Direct Object Reference (IDOR) vulnerability affecting BOLD Workplanner in versions prior to 2.5.25 (build 4935b438f9b). The flaw stems from insufficient validation of user-supplied input when the application processes internal identifiers used to retrieve calendar records. An authenticated user can manipulate these identifiers to access calendar details belonging to other users. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Any authenticated user of BOLD Workplanner can enumerate internal identifiers to read calendar data belonging to other accounts, breaking tenant and user isolation.
Affected Products
- BOLD Workplanner versions prior to 2.5.25
- Fixed build reference: 4935b438f9b
- Vendor: boldworkplanner
Discovery Timeline
- 2025-09-30 - CVE-2025-41091 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-41091
Vulnerability Analysis
BOLD Workplanner exposes calendar resources through endpoints that accept an internal object identifier as a request parameter. The application authenticates the requesting user but fails to verify that the authenticated user is authorized to access the specific calendar object referenced by the identifier. This allows lateral access across accounts by simply substituting the identifier value.
The vulnerability requires only a valid, low-privileged account. Exploitation does not depend on user interaction, custom tooling, or defeating additional access controls. The impact is limited to confidentiality of calendar data; integrity and availability of the application are not affected.
Root Cause
The root cause is a missing authorization check between the authenticated session and the requested resource. The application trusts the client-supplied object identifier without correlating it to the session's ownership or permission scope. This is a textbook CWE-639 pattern where authentication is enforced but object-level authorization is not.
Attack Vector
An attacker with a valid BOLD Workplanner account issues authenticated HTTP requests to calendar endpoints while incrementing or fuzzing the internal identifier parameter. Because identifiers are internal and predictable, enumeration returns calendar details owned by other users. The INCIBE Security Notice provides additional context on the disclosure.
No verified public proof-of-concept code is available for this vulnerability at the time of writing. The mechanism follows standard IDOR exploitation: parameter tampering on authenticated requests targeting object retrieval endpoints.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-41091
Indicators of Compromise
- Repeated authenticated HTTP requests from a single session iterating through sequential or fuzzed calendar identifier values.
- Access patterns where one user account retrieves calendar objects associated with multiple unrelated users in a short time window.
- Application logs showing successful 200 OK responses on calendar endpoints for objects the requesting user does not own.
Detection Strategies
- Correlate authenticated session identifiers with the ownership metadata of accessed calendar objects; flag mismatches.
- Baseline normal per-user calendar access volume and alert on statistical outliers indicative of enumeration.
- Enable verbose application logging on all endpoints that accept object identifiers as parameters.
Monitoring Recommendations
- Forward BOLD Workplanner application and web server logs to a centralized analytics platform for cross-account access correlation.
- Monitor for high-frequency requests to calendar endpoints originating from non-administrative accounts.
- Track any anomalous spikes in unique object identifiers requested per session over rolling time windows.
How to Mitigate CVE-2025-41091
Immediate Actions Required
- Upgrade BOLD Workplanner to version 2.5.25 (build 4935b438f9b) or later.
- Audit application logs for prior enumeration activity across calendar endpoints.
- Rotate or review access for any accounts observed accessing calendars outside their normal scope.
Patch Information
The vendor fix is available in BOLD Workplanner 2.5.25, corresponding to commit reference 4935b438f9b. Refer to the INCIBE Security Notice for advisory details and vendor coordination information.
Workarounds
- Restrict network access to the BOLD Workplanner application to trusted user populations until patching is complete.
- Deploy a web application firewall rule to rate-limit requests to calendar endpoints and detect identifier enumeration.
- Reduce the number of active low-privileged accounts and disable unused accounts pending remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
