CVE-2025-41096: Bold Workplanner IDOR Auth Bypass Flaw

CVE-2025-41096 Overview

CVE-2025-41096 is an Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner affecting versions prior to 2.5.25 (build 4935b438f9b). The flaw stems from missing validation of user-supplied input on requests referencing internal object identifiers. An authenticated user can supply unauthorized internal identifiers to retrieve contract detail dates belonging to other users. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated attackers can read contract detail dates belonging to other users by manipulating internal identifiers, breaking tenant and user data confidentiality.

Affected Products

BOLD Workplanner versions prior to 2.5.25 (build 4935b438f9b)
Vendor: boldworkplanner
Component: boldworkplanner:bold_workplanner

Discovery Timeline

2025-09-30 - CVE-2025-41096 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41096

Vulnerability Analysis

BOLD Workplanner exposes endpoints that return contract detail data indexed by internal identifiers. The application does not verify that the authenticated caller owns the requested identifier before returning results. An attacker with valid credentials can iterate or guess identifier values and receive data for contracts they are not authorized to view. The disclosed data is limited to dates of current contract details, according to the vendor advisory.

The attack requires network access and low-privilege authentication. No user interaction is needed to trigger the flaw. The EPSS probability is 0.251% (percentile 16.276).

Root Cause

The root cause is missing object-level authorization on requests that accept an internal identifier as input. The server trusts the client-supplied identifier and returns the associated record without cross-checking ownership against the current session. This pattern matches CWE-639, where an authorization decision is made based on a user-controlled key rather than the session identity.

Attack Vector

Exploitation is performed over the network against an authenticated session. The attacker intercepts a legitimate request that references a contract identifier, then replaces the identifier with values belonging to other users. The response returns the target record's contract dates. Because identifiers are typically sequential or predictable, enumeration across the tenant is practical without additional tooling.

No public proof-of-concept or exploit tooling is listed in the INCIBE Security Notice.

Detection Methods for CVE-2025-41096

Indicators of Compromise

Application logs showing a single authenticated user requesting many distinct contract identifiers in a short interval.
Sequential or non-sequential identifier enumeration patterns in access logs for contract-related endpoints.
HTTP 200 responses to requests referencing identifiers outside the caller's normal working set.

Detection Strategies

Correlate authenticated session identifiers with the object identifiers accessed and alert on ratios that exceed expected user behavior.
Deploy web application firewall rules that flag rapid iteration of numeric or GUID identifiers in URL paths or query parameters targeting contract endpoints.
Review authentication logs for accounts issuing bursts of API calls to /contract or equivalent Workplanner routes.

Monitoring Recommendations

Enable verbose access logging on BOLD Workplanner and forward logs to a centralized analytics platform for baseline modeling.
Track per-user access to contract records and generate alerts when a user accesses records outside their assigned scope.
Monitor response sizes and status codes on contract endpoints to identify successful unauthorized reads.

How to Mitigate CVE-2025-41096

Immediate Actions Required

Upgrade BOLD Workplanner to version 2.5.25 (build 4935b438f9b) or later.
Audit authentication logs for enumeration patterns against contract endpoints since the version was deployed.
Rotate credentials for accounts showing anomalous access to contract identifiers.

Patch Information

The vendor addressed the issue in BOLD Workplanner 2.5.25 (build 4935b438f9b). Refer to the INCIBE Security Notice for the official disclosure and fix reference.

Workarounds

Restrict application access to trusted networks or VPN-connected users until the patched version is deployed.
Reduce the number of standing low-privilege accounts and enforce least privilege for users who do not require contract visibility.
Enable and review application-level access logs to detect exploitation attempts during the remediation window.

bash

# Verify installed BOLD Workplanner version meets the fixed release
# Replace the endpoint with the appropriate management URL for your deployment
curl -sS https://workplanner.example.com/api/version \
  -H "Authorization: Bearer $TOKEN" \
  | jq '.version'
# Expected: "2.5.25" or higher