CVE-2025-60931: Infor Global HR IDOR Vulnerability

CVE-2025-60931 Overview

CVE-2025-60931 is an Insecure Direct Object Reference (IDOR) vulnerability in the Employee Compensation View function of Infor Global HR v11.24.10.01.33. The flaw allows unauthorized attackers to view compensation information belonging to other employees by issuing a crafted GET request. The vulnerability is categorized under [CWE-639] (Authorization Bypass Through User-Controlled Key) and impacts the confidentiality of sensitive HR data. Exploitation requires no privileges, no user interaction, and can be performed over the network.

Critical Impact
Unauthorized disclosure of employee compensation data across the organization through a single crafted GET request.

Affected Products

Infor Global HR v11.24.10.01.33

Discovery Timeline

2026-07-29 - CVE-2025-60931 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-60931

Vulnerability Analysis

The Employee Compensation View function in Infor Global HR fails to validate whether the requesting user is authorized to view the requested employee record. The application relies on a client-supplied identifier in the GET request to retrieve compensation data. The backend returns the record without checking session ownership or role-based access rights.

An attacker who can reach the application over the network can enumerate identifiers and retrieve salary, bonus, and related compensation information for arbitrary employees. The issue affects confidentiality but does not modify data or disrupt availability. Additional technical analysis is available in the OffSecGuy CVE Analysis.

Root Cause

The root cause is missing object-level authorization on the Employee Compensation View endpoint. The application trusts a user-controlled key, typically an employee identifier passed as a query parameter, to identify which record to return. No server-side check compares the requesting identity against the target employee record or the caller's HR permissions.

Attack Vector

The attack vector is a network-based HTTP GET request against the vulnerable endpoint. An attacker modifies the employee identifier parameter to reference a different employee. The server responds with the target employee's compensation details. Enumeration of sequential or predictable identifiers enables bulk data extraction across the organization.

No verified exploit code or public proof-of-concept is currently listed in Exploit-DB or CISA KEV. The EPSS probability is 0.232%.

Detection Methods for CVE-2025-60931

Indicators of Compromise

Repeated GET requests to the Employee Compensation View endpoint with sequential or varied employee identifier parameters from a single session.
HTTP 200 responses returning compensation records for employee IDs unrelated to the authenticated user's role or scope.
Unusual volumes of compensation-record retrievals outside standard HR business hours or from non-HR user accounts.

Detection Strategies

Instrument the Infor Global HR application logs to record the authenticated user, target employee ID, and endpoint for every compensation view request.
Compare requested employee IDs against the caller's authorized HR scope and flag mismatches.
Deploy web application firewall rules that alert on rapid identifier enumeration patterns against /EmployeeCompensationView style paths.

Monitoring Recommendations

Baseline normal compensation-view activity per user role and alert on statistical deviations.
Forward Infor Global HR access logs to a centralized SIEM for correlation with identity and session telemetry.
Review privileged and service account activity against the affected endpoint on a recurring basis.

How to Mitigate CVE-2025-60931

Immediate Actions Required

Contact Infor support to obtain patch guidance for Infor Global HR v11.24.10.01.33 and apply the fix once released.
Restrict network exposure of the Infor Global HR application to trusted corporate networks or VPN users only.
Audit recent access logs for signs of employee identifier enumeration against the Employee Compensation View function.

Patch Information

No vendor advisory URL is currently listed in the NVD entry for CVE-2025-60931. Customers should engage Infor directly to confirm patch availability and upgrade paths from v11.24.10.01.33. Refer to the OffSecGuy CVE Analysis for additional context while awaiting vendor guidance.

Workarounds

Implement a reverse-proxy or WAF rule that validates the requested employee ID against the authenticated session before forwarding requests to the Employee Compensation View endpoint.
Reduce HR user permissions to the minimum required and disable compensation-view access for accounts that do not require it.
Enable verbose access logging on the affected endpoint and route logs to a monitored SIEM until a vendor patch is applied.

bash

# Example WAF rule concept (ModSecurity syntax) - adapt to your environment
SecRule REQUEST_URI "@contains /EmployeeCompensationView" \
  "id:1060931,phase:2,deny,status:403,\
   msg:'Block unauthorized IDOR access to Employee Compensation View',\
   chain"
  SecRule ARGS:employeeId "!@streq %{SESSION.authorized_employee_id}" \
    "t:none"