CVE-2026-92419 Overview
CVE-2026-92419 is an Insecure Direct Object Reference (IDOR) vulnerability in WEBCON Business Process Suite (BPS). The flaw resides in the /api/vacations/{path} endpoint used by the Gantt vacation chart feature. The selectedPeople parameter accepts arbitrary user logins without verifying that the caller is authorized to view those users' records. An authenticated attacker can enumerate vacation schedules of other employees, including managers and staff across offices, bypassing business logic access restrictions. The result is unauthorized disclosure of sensitive scheduling information. WEBCON addressed the issue in versions 2025.2.1.177 and 2026.1.1.20.
Critical Impact
Any authenticated WEBCON BPS user can retrieve vacation data for arbitrary employees by supplying their logins in the selectedPeople parameter, exposing organizational scheduling data and staff movements.
Affected Products
- WEBCON BPS versions prior to 2025.2.1.177
- WEBCON BPS versions prior to 2026.1.1.20
- Deployments exposing the Gantt vacation chart /api/vacations/{path} endpoint
Discovery Timeline
- 2026-09-23 - CVE-2026-92419 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-92419
Vulnerability Analysis
The vulnerability is a classic Insecure Direct Object Reference [CWE-639] in the WEBCON BPS vacations API. The Gantt vacation chart endpoint accepts a selectedPeople parameter that identifies which users' schedules to return. The server-side handler queries and returns the requested vacation records without evaluating whether the authenticated caller has business-level permission to view those individuals.
Because access control decisions are missing at the resource layer, the endpoint honors any user login supplied by the client. An attacker with a valid low-privileged account can iterate through user identifiers to reconstruct organizational schedules. The exposed data supports downstream reconnaissance for social engineering, targeted phishing during known absences, or intrusions timed against manager availability.
Root Cause
The root cause is missing authorization on a user-controlled reference. The API trusts the selectedPeople values sent by the client and executes the query with the application's data-access privileges rather than the caller's effective permissions. No object-level policy is enforced against the requesting principal, which is the defining pattern of [CWE-639].
Attack Vector
Exploitation requires network access to the WEBCON BPS application and a valid authenticated session with only low privileges. The attacker issues a request to /api/vacations/{path} with the selectedPeople parameter populated with target user logins, either singly or in bulk. The endpoint returns the vacation schedules regardless of whether the caller's role or organizational unit would normally permit that view.
See the CERT Poland CVE-2026-92419 Analysis for the vendor coordination details and reproduction context.
Detection Methods for CVE-2026-92419
Indicators of Compromise
- Requests to /api/vacations/ endpoints containing multiple or unusual values in the selectedPeople parameter.
- Single authenticated sessions issuing vacation API calls that enumerate large lists of user logins in short time windows.
- Access patterns where a user account queries vacation data for peers or managers outside their organizational unit.
Detection Strategies
- Review web server and reverse-proxy logs for /api/vacations/{path} requests and correlate the authenticated user against the selectedPeople values.
- Baseline normal callers of the Gantt vacation chart and alert on accounts requesting significantly more distinct user logins than their historical average.
- Add application-layer logging that records the caller identity alongside every resolved selectedPeople entry to support retrospective hunting.
Monitoring Recommendations
- Forward WEBCON BPS application and IIS logs to a centralized SIEM for continuous query and long-term retention.
- Build alerts for authenticated enumeration behavior against the vacations API, including high request rates and broad login coverage.
- Track post-patch behavior to confirm that unauthorized selectedPeople requests are rejected by the fixed versions.
How to Mitigate CVE-2026-92419
Immediate Actions Required
- Upgrade WEBCON BPS to version 2025.2.1.177 or 2026.1.1.20, matching the branch in production.
- Audit historical access logs for the /api/vacations/{path} endpoint to identify prior enumeration of employee schedules.
- Restrict access to WEBCON BPS to trusted networks or VPN users where feasible to reduce the pool of potential authenticated attackers.
Patch Information
WEBCON released fixed builds in versions 2025.2.1.177 and 2026.1.1.20. Administrators should apply the appropriate branch update following WEBCON's standard upgrade guidance. Refer to the CERT Poland CVE-2026-92419 Analysis for coordination details and fixed-version confirmation.
Workarounds
- If immediate patching is not possible, restrict access to the Gantt vacation chart feature to a limited set of roles through application configuration.
- Place a reverse proxy or web application firewall rule in front of /api/vacations/{path} that constrains or validates the selectedPeople parameter values against the caller's identity.
- Disable or hide the vacation Gantt module for standard users until the patched version is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.