CVE-2025-41099: Bold Workplanner IDOR Auth Bypass Flaw

CVE-2025-41099 Overview

CVE-2025-41099 is an Insecure Direct Object Reference (IDOR) vulnerability affecting BOLD Workplanner versions prior to 2.5.25 (build 4935b438f9b). The flaw stems from insufficient validation of user input when accessing permission records. An authenticated user can manipulate internal identifiers to enumerate and read the list of permissions belonging to other accounts. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key. The Spanish National Cybersecurity Institute (INCIBE) coordinated disclosure of the issue.

Critical Impact

Authenticated attackers can access permission data belonging to other users by supplying unauthorized internal identifiers, breaking tenant and role boundaries within the application.

Affected Products

• BOLD Workplanner versions prior to 2.5.25
• BOLD Workplanner build identifier 4935b438f9b and earlier
• Deployments exposing the permissions API endpoint to authenticated users

Discovery Timeline

• 2025-09-30 - CVE-2025-41099 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41099

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in the BOLD Workplanner web application. The application accepts an internal identifier from the client to retrieve permission records. It does not verify that the authenticated requester owns, or is authorized to view, the referenced object. As a result, any authenticated user can substitute identifiers belonging to other users or tenants and retrieve their permission lists. The confidentiality impact is high while integrity and availability are unaffected, matching an information-disclosure outcome rather than data tampering.

Root Cause

The root cause is missing object-level authorization on the permissions endpoint, consistent with CWE-639. The backend trusts a user-controlled key to locate the target record. It performs the lookup without comparing the record's owner against the session principal. This pattern is a common failure in multi-tenant applications where identifiers are sequential or otherwise guessable.

Attack Vector

Exploitation requires network access to the application and valid low-privilege credentials. No user interaction is needed. An attacker authenticates, intercepts a legitimate request to the permissions endpoint, and iterates the internal identifier parameter. Each modified request returns the permission list associated with the referenced identifier. Refer to the INCIBE Security Notice for the coordinated advisory. No public proof-of-concept exploit is listed in NVD at the time of writing.

Detection Methods for CVE-2025-41099

Indicators of Compromise

• Repeated authenticated requests to permission-related endpoints with sequentially changing identifier parameters from a single session.
• HTTP 200 responses to permission lookups where the returned object owner does not match the authenticated session principal.
• Unexpected enumeration patterns originating from low-privilege user accounts.

Detection Strategies

• Enable verbose application logging on the permissions API and record both the requesting user and the owner of the returned object for correlation.
• Deploy web application firewall rules that flag high-rate identifier iteration against the vulnerable endpoint.
• Review access logs for user accounts that read permission records outside their assigned scope or tenant.

Monitoring Recommendations

• Alert on a single session issuing many permission read requests within a short interval.
• Correlate authentication events with permission-endpoint access to surface anomalous low-privilege accounts performing broad reads.
• Forward application and reverse-proxy logs to a central analytics platform and retain them long enough to investigate retroactive abuse.

How to Mitigate CVE-2025-41099

Immediate Actions Required

• Upgrade BOLD Workplanner to version 2.5.25 (build 4935b438f9b) or later.
• Audit application logs for prior enumeration of permission records by non-administrative users.
• Rotate credentials and review assigned permissions for accounts that may have been exposed through the IDOR.

Patch Information

The vendor fixed the issue in BOLD Workplanner version 2.5.25 (build 4935b438f9b). Organizations running earlier releases should plan an upgrade using the vendor's standard update process. See the INCIBE Security Notice for the coordinated advisory details.

Workarounds

• Restrict access to the BOLD Workplanner application to trusted networks or VPN users until the patch is applied.
• Reduce the number of authenticated accounts and remove unused low-privilege users to shrink the attack surface.
• Place a reverse proxy or WAF in front of the application to rate-limit and log requests to permission endpoints.

# Example WAF rate-limit rule (nginx) for permissions endpoint
limit_req_zone $binary_remote_addr zone=perm_api:10m rate=5r/s;

location /api/permissions/ {
    limit_req zone=perm_api burst=10 nodelay;
    proxy_pass http://workplanner_backend;
}