CVE-2026-10597: OMICARD EDM IDOR Vulnerability

CVE-2026-10597 Overview

CVE-2026-10597 is an Insecure Direct Object Reference (IDOR) vulnerability in OMICARD EDM, an email direct marketing platform developed by ITPison. The flaw allows unauthenticated remote attackers to modify a specific request parameter and retrieve email addresses belonging to other users. The weakness is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Remote, unauthenticated attackers can enumerate and harvest user email addresses by tampering with object identifiers in HTTP requests, enabling targeted phishing and downstream abuse.

Affected Products

OMICARD EDM (developed by ITPison)
Specific affected versions are not enumerated in the advisory
See vendor advisories for impacted builds

Discovery Timeline

2026-06-04 - CVE-2026-10597 published to NVD
2026-06-04 - Last updated in NVD database

Technical Details for CVE-2026-10597

Vulnerability Analysis

The vulnerability resides in an OMICARD EDM endpoint that references user records via a client-controlled identifier. The application returns the associated email address without verifying that the requester is authorized to access the object. Because no authentication is required, an attacker can iterate over identifier values to enumerate the email addresses of registered users.

The scope is limited to confidentiality of email address data. Integrity and availability of the underlying system are not affected based on the advisory. However, harvested addresses can be weaponized for phishing campaigns, credential stuffing reconnaissance, and spam distribution at scale.

Root Cause

The root cause is missing server-side authorization on a parameter that directly maps to a user record. The application trusts the supplied identifier and performs the lookup without validating the requester's session, role, or ownership of the referenced object. This pattern matches the classic IDOR weakness described in CWE-639.

Attack Vector

Exploitation occurs over the network with low attack complexity and no privileges or user interaction. An attacker sends a crafted HTTP request to the vulnerable endpoint, substituting the targeted parameter value with sequential or guessed identifiers. The server responds with the email address associated with each identifier. Automated scripts can quickly enumerate large portions of the user base.

No verified proof-of-concept code has been published. For technical context, refer to the TWCERT Security Advisory (English) and TWCERT Security Advisory (Chinese).

Detection Methods for CVE-2026-10597

Indicators of Compromise

Sequential or rapidly incrementing values in identifier parameters within OMICARD EDM HTTP request logs
High volumes of requests from a single source IP to the affected endpoint with varying parameter values
Unauthenticated requests returning HTTP 200 responses containing email address fields

Detection Strategies

Inspect web server and application logs for repeated access to the affected OMICARD EDM endpoint with changing object identifiers
Establish a baseline of normal request patterns and alert on deviations such as enumeration-style traffic bursts
Correlate user-agent strings, source IPs, and request rates to identify scripted enumeration attempts

Monitoring Recommendations

Enable verbose access logging on the OMICARD EDM application and forward logs to a centralized SIEM for analysis
Deploy a web application firewall (WAF) rule to flag rapid sequential parameter access patterns
Monitor outbound spam or phishing reports referencing email addresses sourced from the OMICARD EDM user base

How to Mitigate CVE-2026-10597

Immediate Actions Required

Contact ITPison to obtain the fixed release of OMICARD EDM and apply it across all instances
Restrict network exposure of the affected endpoint to trusted networks or VPN access until patched
Review historical access logs for signs of prior enumeration activity and notify potentially impacted users

Patch Information

ITPison has issued advisories through TWCERT. Administrators should consult the TWCERT Security Advisory (English) and the TWCERT Security Advisory (Chinese) for fixed version details and vendor remediation guidance.

Workarounds

Place the OMICARD EDM application behind an authenticating reverse proxy so unauthenticated requests to the affected endpoint are blocked
Implement WAF rules that require a valid session cookie before allowing access to user-object endpoints
Rate-limit requests to endpoints that accept user identifiers to slow enumeration attempts

bash

# Example WAF rate-limit rule (ModSecurity-style pseudocode)
SecRule REQUEST_URI "@beginsWith /omicard/user" \
  "id:1010597,phase:1,deny,status:429,\
   msg:'Rate limit exceeded for OMICARD user endpoint',\
   chain"
  SecRule IP:REQ_COUNT "@gt 30"