CVE-2026-94149: Omega Solution HRM OS RCE Vulnerability

CVE-2026-94149 Overview

CVE-2026-94149 affects Omega Solution HRM OS versions up to 20260717. The flaw resides in the Role Permission Retrieval Endpoint at /role-permission/permission, where the roleId argument is not properly validated. An authenticated remote attacker can manipulate this parameter to trigger improper control of resource identifiers [CWE-99]. The vulnerability is classified as low severity, but a public proof of concept increases exposure risk. The vendor was contacted early about this disclosure but did not respond.

Critical Impact

Authenticated remote attackers can manipulate the roleId parameter to access role-permission resources they should not be able to reference, exposing limited confidentiality of role configuration data.

Affected Products

• Omega Solution HRM OS versions up to 20260717
• Role Permission Retrieval Endpoint (/role-permission/permission)
• Deployments exposing the HRM OS web interface to remote users

Discovery Timeline

• 2026-09-21 - CVE-2026-94149 published to NVD
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94149

Vulnerability Analysis

The vulnerability sits in the Role Permission Retrieval Endpoint of Omega Solution HRM OS. The endpoint accepts a roleId argument and uses it to look up role permission data without adequate validation of the identifier. This weakness maps to CWE-99: Improper Control of Resource Identifiers, commonly referred to as Resource Injection. An attacker with low-privilege authenticated access can supply arbitrary identifiers to reference resources outside the intended authorization scope. Only confidentiality is impacted, and only at a limited level, but the exposure of role and permission metadata can support follow-on reconnaissance against the application. A public proof of concept is referenced in the PoCVulDb GitHub issue.

Root Cause

The root cause is missing or insufficient validation of the roleId parameter before it is used to identify a backend resource. The application trusts the client-supplied identifier and does not confirm that the requesting user has legitimate access to the referenced role. Improper control of resource identifiers of this type typically stems from directly binding request parameters to database or object lookups without an authorization boundary check.

Attack Vector

Exploitation occurs over the network against the HRM OS web application. The attacker requires low-privilege authentication but no user interaction. By submitting a crafted request to /role-permission/permission with a modified roleId value, the attacker can enumerate or retrieve role-permission entries associated with identifiers outside their assigned scope. The exploit is publicly available, as documented in the VulDB advisory for CVE-2026-94149.

No verified exploit code is reproduced here. Refer to the PoCVulDb reference for public technical details.

Detection Methods for CVE-2026-94149

Indicators of Compromise

• Repeated HTTP requests to /role-permission/permission with sequentially incrementing or fuzzed roleId values from a single authenticated session
• Access log entries showing low-privilege accounts retrieving role-permission data for roles outside their assignment
• Requests to the endpoint originating from unexpected IP ranges or automation user agents

Detection Strategies

• Instrument the HRM OS application logs to capture full request URIs and the authenticated user for each call to /role-permission/permission.
• Correlate roleId values seen in requests against the roles legitimately assigned to the calling user and alert on mismatches.
• Deploy web application firewall rules that flag high-cardinality enumeration of the roleId parameter within short time windows.

Monitoring Recommendations

• Establish a baseline for normal read volume against the Role Permission Retrieval Endpoint and alert on statistically significant spikes.
• Monitor for authenticated session activity that accesses administrative role identifiers from non-administrative accounts.
• Forward HRM OS access logs to a centralized analytics platform for retention and retrospective hunting once patch guidance is available.

How to Mitigate CVE-2026-94149

Immediate Actions Required

• Restrict network access to the HRM OS /role-permission/permission endpoint to trusted internal networks or VPN users where feasible.
• Review authenticated user accounts and revoke access for stale, shared, or unnecessary low-privilege accounts that could be used to reach the endpoint.
• Audit application logs for prior enumeration of the roleId parameter and validate that no unauthorized role data was retrieved.

Patch Information

No vendor patch has been published. According to the disclosure, the vendor was contacted early but did not respond. Track the VulDB entry for CVE-2026-94149 for updates and monitor Omega Solution communications for a fixed release beyond version 20260717.

Workarounds

• Enforce server-side authorization checks in front of the endpoint using a reverse proxy that validates the requesting user's role against the requested roleId.
• Apply a web application firewall rule to block requests where the roleId value does not match an allowlist of identifiers tied to the authenticated session.
• Reduce the number of accounts granted access to the HRM OS application to limit the population able to authenticate and reach the vulnerable endpoint.
• Increase logging verbosity on the endpoint to support rapid detection while a permanent fix is pending.

# Example WAF rule concept (ModSecurity-style, illustrative)
SecRule REQUEST_URI "@beginsWith /role-permission/permission" \
    "id:1094149,phase:2,deny,status:403,\
    msg:'Block untrusted roleId enumeration (CVE-2026-94149)',\
    chain"
    SecRule ARGS:roleId "!@rx ^[0-9]{1,6}$" "t:none"