CVE-2025-41098 Overview
CVE-2025-41098 is an Insecure Direct Object Reference (IDOR) vulnerability affecting BOLD Workplanner versions prior to 2.5.25 (build 4935b438f9b). The flaw stems from the misuse of the general enquiry web service, which fails to enforce proper authorization checks on object references supplied by authenticated users.
An attacker with low-privilege network access can manipulate object identifiers to access data belonging to other users or tenants. The vulnerability maps to CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated attackers can retrieve sensitive records by tampering with object identifiers in requests to the general enquiry web service, breaking confidentiality boundaries between users.
Affected Products
- BOLD Workplanner versions prior to 2.5.25
- Build identifier 4935b438f9b and earlier
- Deployments exposing the general enquiry web service
Discovery Timeline
- 2025-09-30 - CVE-2025-41098 published to NVD
- 2025-10-08 - Last updated in NVD database
Technical Details for CVE-2025-41098
Vulnerability Analysis
The vulnerability resides in the general enquiry web service of BOLD Workplanner. The service accepts user-supplied identifiers that reference internal objects without verifying whether the requesting user is authorized to access the referenced record.
An attacker who holds valid low-privilege credentials can iterate through identifier values or substitute identifiers belonging to other accounts. The backend returns the requested object data because the authorization layer relies solely on authentication status rather than ownership verification.
The flaw is classified as [CWE-639]. It does not require elevated permissions or user interaction, and the attack proceeds entirely over the network. The impact is confined to confidentiality of accessed records; integrity and availability of the application remain unaffected based on the published CVSS metrics.
Root Cause
The root cause is a missing authorization check between authenticated session context and the object identifier supplied in requests to the general enquiry web service. The application trusts client-controlled keys without cross-referencing them against the session owner.
Attack Vector
Exploitation requires network access to the BOLD Workplanner instance and a valid authenticated session at any privilege level. The attacker submits crafted requests to the general enquiry endpoint, swapping the target object identifier for one belonging to another user.
The server responds with the referenced record, disclosing information that should be restricted. No specialized tooling is required beyond an HTTP client capable of replaying authenticated requests. See the INCIBE Security Notice for additional technical context.
Detection Methods for CVE-2025-41098
Indicators of Compromise
- Repeated authenticated requests to the general enquiry web service with sequentially varying identifier parameters
- Single user sessions retrieving records associated with multiple distinct account identifiers
- Unusual response volume from the enquiry endpoint correlated with low-privilege user accounts
Detection Strategies
- Inspect web server and application logs for high-frequency access patterns against the general enquiry service from individual sessions
- Build correlation rules that flag authenticated users accessing object identifiers outside their assigned scope
- Compare requested object identifiers against the authenticated user's authorized resource set and alert on mismatches
Monitoring Recommendations
- Enable verbose application logging on the general enquiry web service, capturing user identifier, requested object identifier, and response status
- Forward web service logs to a centralized SIEM or data lake for retention and correlation
- Establish a baseline of normal enquiry volumes per user role and alert on deviations
How to Mitigate CVE-2025-41098
Immediate Actions Required
- Upgrade BOLD Workplanner to version 2.5.25 (build 4935b438f9b) or later
- Review authentication logs for anomalous access patterns to the general enquiry web service prior to patching
- Rotate credentials for accounts that may have been used to enumerate object identifiers
Patch Information
The vendor has resolved CVE-2025-41098 in BOLD Workplanner version 2.5.25 (build 4935b438f9b). Apply the vendor-supplied update across all instances. Refer to the INCIBE Security Notice for additional vendor guidance.
Workarounds
- Restrict network exposure of the BOLD Workplanner application to trusted networks until the patch is applied
- Implement a reverse proxy or web application firewall rule that validates object identifier parameters against the authenticated session context
- Reduce the number of authenticated accounts able to reach the general enquiry web service while remediation is pending
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
