CVE-2025-41097: Bold Workplanner IDOR Auth Bypass Flaw

CVE-2025-41097 Overview

CVE-2025-41097 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting BOLD Workplanner versions prior to 2.5.25 (commit 4935b438f9b). The flaw stems from insufficient validation of user input against internal object identifiers. An authenticated attacker can manipulate internal identifiers in application requests to access basic employee details belonging to other users. The vulnerability was cataloged in the Spanish National Cybersecurity Institute (INCIBE) advisory database.

Critical Impact

Authenticated users can enumerate internal identifiers to retrieve basic employee information they are not authorized to view, breaching confidentiality of workforce data.

Affected Products

• BOLD Workplanner versions prior to 2.5.25 (build 4935b438f9b)

Discovery Timeline

• 2025-09-30 - CVE-2025-41097 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41097

Vulnerability Analysis

BOLD Workplanner is a workforce planning application that exposes employee records through authenticated endpoints. The application references those records using internal identifiers passed in client requests. The application does not verify whether the authenticated session is authorized to access the requested identifier. As a result, an authenticated user can substitute another employee's identifier and receive that employee's basic details. This class of flaw is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

The issue does not require elevated privileges. Any account with valid authentication to the application can iterate through identifier values and harvest employee data. Impact is limited to confidentiality of employee details; integrity and availability are not affected according to the published CVSS vector.

Root Cause

The root cause is missing object-level authorization. The application trusts client-supplied identifiers as authoritative references without cross-checking the identifier against the session's permission scope. Direct references to internal objects, such as sequential numeric IDs, are exposed to the client and can be modified.

Attack Vector

The attack occurs over the network against an authenticated session. An attacker logs into BOLD Workplanner with valid credentials, intercepts a legitimate request that references an employee identifier, and then replays the request with modified identifier values. Each modified request returns data associated with the substituted identifier. Automation allows sequential enumeration of the identifier space to bulk-collect employee details.

No verified proof-of-concept code has been published. See the INCIBE Security Notice for the vendor-coordinated advisory.

Detection Methods for CVE-2025-41097

Indicators of Compromise

• Repeated authenticated requests to the same employee-lookup endpoint with sequential or incrementing identifier values from a single session.
• Elevated response volumes returning employee records to accounts that historically access only their own profile.
• Unusual off-hours enumeration patterns against BOLD Workplanner APIs from a small number of user accounts.

Detection Strategies

• Instrument the application or its reverse proxy to log the authenticated user, the requested object identifier, and the authorization decision for every employee-data endpoint.
• Baseline the normal number of distinct employee identifiers each account accesses per day and alert on statistical outliers.
• Correlate application access logs with HR role assignments to flag sessions retrieving records outside their functional scope.

Monitoring Recommendations

• Forward BOLD Workplanner web server and application logs to a centralized SIEM or data lake for retention and query.
• Build detection rules that trigger on high cardinality of unique employeeId values requested per session within a short window.
• Review authentication logs for account sharing or credential reuse that could mask enumeration activity.

How to Mitigate CVE-2025-41097

Immediate Actions Required

• Upgrade BOLD Workplanner to version 2.5.25 (build 4935b438f9b) or later on all deployments.
• Inventory accounts with access to the application and disable dormant or unnecessary user credentials.
• Review recent application logs for identifier enumeration patterns to determine whether exploitation has occurred.

Patch Information

The vendor addressed the vulnerability in BOLD Workplanner version 2.5.25, released with commit reference 4935b438f9b. Refer to the INCIBE Security Notice for coordinated disclosure details and vendor guidance.

Workarounds

• Restrict application access to trusted networks using VPN or IP allowlisting until the patch is applied.
• Reduce the population of authenticated users to the minimum required for business operations.
• Enable verbose access logging on the reverse proxy fronting BOLD Workplanner to support post-incident review.

# Example nginx access log configuration to capture identifier parameters
log_format idor_audit '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     'args="$args"';
access_log /var/log/nginx/workplanner_audit.log idor_audit;