CVE-2025-41094: Bold Workplanner Auth Bypass Vulnerability

CVE-2025-41094 Overview

CVE-2025-41094 is an Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner versions prior to 2.5.25 (build 4935b438f9b). The flaw stems from insufficient validation of user-supplied input when the application processes internal identifiers. An authenticated user can manipulate these identifiers to access functional contract details belonging to other users or entities. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key. Spain's INCIBE-CERT published the coordinated advisory covering this vulnerability.

Critical Impact

Any authenticated user of BOLD Workplanner can enumerate internal identifiers to retrieve contract data they are not authorized to view, resulting in confidentiality loss of sensitive business information.

Affected Products

• BOLD Workplanner versions prior to 2.5.25 (build 4935b438f9b)
• BOLD Workplanner GPS module (as referenced in the INCIBE-CERT notice)
• Deployments exposing the affected contract-detail endpoints to authenticated users

Discovery Timeline

• 2025-09-30 - CVE-2025-41094 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41094

Vulnerability Analysis

BOLD Workplanner exposes application endpoints that accept internal identifiers as parameters to retrieve contract records. The server-side logic authenticates the caller but fails to verify that the caller is authorized to access the specific identifier requested. Authenticated attackers can iterate or guess identifier values and receive contract data belonging to other tenants, users, or business units.

The vulnerability requires only valid credentials to the application. No elevated privileges are needed, and no user interaction beyond issuing crafted HTTP requests is required. The impact is limited to confidentiality: integrity and availability of the underlying data are not directly affected by this weakness.

Root Cause

The root cause is a missing object-level authorization check, aligned with [CWE-639]. The application trusts the internal identifier submitted by the authenticated client and does not re-validate that the current session owns or has been granted access to the referenced contract resource. This is a common pattern in web applications that rely on session authentication alone rather than per-object authorization.

Attack Vector

The attack vector is network-based over the application's standard HTTP interface. An attacker registers or compromises a low-privilege account, then modifies identifier parameters in API or web requests that return contract details. Because identifiers are typically sequential or predictable, the attacker can enumerate ranges to harvest contract records at scale. Refer to the INCIBE-CERT advisory for coordinated disclosure details.

Detection Methods for CVE-2025-41094

Indicators of Compromise

• Sequential or high-volume requests from a single authenticated session against contract-detail endpoints with varying identifier values
• Successful HTTP 200 responses returning contract data for identifiers outside the requesting user's normal scope
• Anomalous data-egress patterns from accounts that historically read only a small number of contract records

Detection Strategies

• Enable verbose access logging on BOLD Workplanner endpoints that accept contract or resource identifiers, and baseline typical per-user access patterns
• Deploy web application firewall rules that alert on rapid enumeration of numeric or UUID identifiers by a single session
• Correlate authentication events with object-access events to identify sessions accessing objects outside their assigned scope

Monitoring Recommendations

• Monitor for spikes in request rate against contract API endpoints, especially from newly created or low-privilege accounts
• Track distinct identifier counts per session per hour and alert when values exceed the established baseline
• Review audit logs for read operations against contract records that do not correlate with a legitimate business workflow

How to Mitigate CVE-2025-41094

Immediate Actions Required

• Upgrade BOLD Workplanner to version 2.5.25 (build 4935b438f9b) or later
• Audit application access logs since deployment for signs of identifier enumeration or unauthorized contract access
• Rotate credentials for any accounts suspected of being used to enumerate contract data
• Restrict access to the BOLD Workplanner application to trusted networks where feasible

Patch Information

The vendor addressed the issue in BOLD Workplanner 2.5.25 (commit reference 4935b438f9b). Administrators should consult the INCIBE-CERT notice and the vendor for upgrade instructions and any additional hardening guidance released alongside the patch.

Workarounds

• Limit application accounts to the minimum required privilege and disable unused accounts to reduce the attacker's foothold
• Place the application behind a reverse proxy or WAF configured to rate-limit requests to contract-detail endpoints
• Apply network-level segmentation so that the application is not reachable from untrusted networks pending the upgrade

# Example WAF rate-limit rule (ModSecurity syntax) to slow identifier enumeration
SecAction "id:1001001,phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR}"
SecRule REQUEST_URI "@rx /contract/details" \
  "id:1001002,phase:1,deny,status:429,\
   setvar:ip.contract_hits=+1,expirevar:ip.contract_hits=60,\
   chain"
  SecRule IP:CONTRACT_HITS "@gt 30" \
    "msg:'Possible IDOR enumeration against BOLD Workplanner'"