CVE-2025-41095 Overview
CVE-2025-41095 is an Insecure Direct Object Reference (IDOR) vulnerability affecting BOLD Workplanner versions prior to 2.5.25 (commit 4935b438f9b). The flaw stems from inadequate validation of user-supplied input on requests referencing internal object identifiers. An authenticated user can manipulate these identifiers to access planning counter details belonging to other users or entities. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and was published to the National Vulnerability Database on September 30, 2025.
Critical Impact
Authenticated attackers can enumerate and read planning counter records belonging to other tenants or users, resulting in unauthorized disclosure of sensitive workforce planning data.
Affected Products
- BOLD Workplanner versions prior to 2.5.25
- BOLD Workplanner builds preceding commit 4935b438f9b
- Deployments exposing the planning counter API endpoints to authenticated users
Discovery Timeline
- 2025-09-30 - CVE-2025-41095 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-41095
Vulnerability Analysis
The vulnerability is a server-side authorization flaw in the BOLD Workplanner web application. The application exposes planning counter details through endpoints that accept internal identifiers as parameters. The backend fails to verify whether the authenticated principal is entitled to the referenced object before returning it.
An attacker with a valid low-privilege account can substitute the identifier in the request with values belonging to other users or organizational units. The server returns the requested record without performing an ownership or role-based access check. This exposes planning counter data that should be restricted to authorized personnel.
The defect is confidentiality-only. It does not directly enable modification of data or denial of service based on the classification in the advisory. Impact scales with the number of records accessible through predictable or enumerable identifiers.
Root Cause
The root cause is missing object-level authorization on API handlers that resolve planning counter records by internal ID. The application trusts the identifier supplied by the client and does not enforce that the requesting session owns or has explicit access to the target object. This maps directly to CWE-639.
Attack Vector
Exploitation requires network access to the application and valid authentication as any user. The attacker intercepts a legitimate request that references a planning counter identifier, then iterates or substitutes that identifier with values corresponding to other records. No user interaction from the victim is required. See the INCIBE Security Notice for the coordinating advisory.
No public proof-of-concept or exploit is currently listed for CVE-2025-41095, and it is not present on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-41095
Indicators of Compromise
- Repeated authenticated HTTP requests from a single session targeting planning counter endpoints with sequentially varying identifier parameters.
- Access log entries showing a single user account retrieving planning counter records associated with multiple distinct owners in a short window.
- Anomalous volumes of HTTP 200 responses to object-lookup endpoints relative to the account's historical baseline.
Detection Strategies
- Instrument the application to log the authenticated user identifier alongside every object identifier accessed, then alert when a user reads records outside their assigned scope.
- Deploy a web application firewall or API gateway rule that flags rapid enumeration patterns against identifier-bearing endpoints.
- Correlate application audit logs with identity data to detect cross-tenant or cross-department read patterns that violate role assignments.
Monitoring Recommendations
- Retain BOLD Workplanner application and reverse-proxy logs for at least 90 days to support retrospective hunting once the patch is applied.
- Baseline expected access patterns per role and alert on statistical deviations in object-access volume.
- Monitor authentication logs for accounts exhibiting scraping behavior immediately after sign-in.
How to Mitigate CVE-2025-41095
Immediate Actions Required
- Upgrade BOLD Workplanner to version 2.5.25 (build 4935b438f9b) or later on all deployed instances.
- Inventory all accounts with access to the application and disable dormant or unnecessary user accounts to shrink the exploitation surface.
- Review recent application logs for enumeration patterns against planning counter endpoints and investigate any anomalies.
Patch Information
The vendor has resolved the flaw in BOLD Workplanner version 2.5.25, identified by commit 4935b438f9b. Refer to the INCIBE Security Notice for coordinated disclosure details. No vendor advisory URL is listed in the NVD record beyond the INCIBE reference.
Workarounds
- Restrict network access to the BOLD Workplanner application to trusted internal networks or VPN users until the upgrade is completed.
- Enforce least-privilege role assignments so that fewer accounts hold access to planning counter data during the mitigation window.
- Enable verbose application audit logging and actively monitor object-access events for cross-account reads until the patched build is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
