CVE-2026-94152: FBP Fulfillment Authorization Bypass Flaw

CVE-2026-94152 Overview

CVE-2026-94152 is an authorization bypass vulnerability in Omega Solution FBP Fulfillment by People 2025. The flaw resides in an unspecified function within the /user/ endpoint of the User Profile API component. Attackers can manipulate the ID parameter to bypass authorization controls and access resources belonging to other users. Exploitation requires network access and low-level authenticated privileges, but no user interaction. The vendor was contacted early about this disclosure but did not respond, and a public proof-of-concept has been released. The weakness maps to [CWE-285] Improper Authorization.

Critical Impact
Authenticated remote attackers can bypass authorization checks on the User Profile API by manipulating the ID parameter, exposing user profile data belonging to other accounts.

Affected Products

Omega Solution FBP Fulfillment by People 2025
Component: User Profile API (/user/ endpoint)
Specific patched versions: Not Available

Discovery Timeline

2026-09-21 - CVE-2026-94152 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database
Vendor response - The vendor was contacted prior to disclosure but did not respond

Technical Details for CVE-2026-94152

Vulnerability Analysis

The vulnerability affects the User Profile API exposed at the /user/ path. The application accepts an ID argument that identifies the user resource being requested or modified. It fails to verify that the authenticated session owns the referenced identifier before returning or modifying data. This behavior aligns with [CWE-285] Improper Authorization, a classic Insecure Direct Object Reference (IDOR) pattern.

An attacker with any low-privilege account can iterate values of the ID parameter to enumerate or interact with profiles belonging to other users. The confidentiality impact is limited to profile data exposed by the endpoint, while integrity and availability are not directly affected according to the published scoring. A public proof-of-concept is available through the referenced GitHub PoC Issue, which lowers the barrier to exploitation.

Root Cause

The root cause is missing server-side authorization enforcement on the User Profile API. The endpoint relies on the client-supplied ID value without checking whether the authenticated principal is authorized to access that specific object. Authentication alone gates the route, but object-level access control is absent.

Attack Vector

Exploitation occurs over the network against the /user/ endpoint. The attacker authenticates with low privileges, then substitutes another user's identifier in the ID parameter of the request. No user interaction or elevated privileges are required. Consult the VulDB Vulnerability Details and GitHub PoC Issue for request-level specifics.

// No verified exploitation code is reproduced here.
// See the linked PoC repository for the disclosed request pattern
// against the /user/ endpoint with a manipulated ID parameter.

Detection Methods for CVE-2026-94152

Indicators of Compromise

Repeated requests to /user/ with sequential or enumerated ID values from a single session or source address
HTTP 200 responses to /user/?ID= requests where the returned profile identifier does not match the authenticated user
Access log entries showing one authenticated account requesting numerous distinct user identifiers within a short window

Detection Strategies

Correlate application session identifiers with the ID parameter value in /user/ requests and alert when they diverge
Deploy web application firewall (WAF) rules that flag ID enumeration patterns against the User Profile API
Baseline normal per-user access rates to /user/ and alert on statistical outliers indicating enumeration

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform for correlation across sessions and source addresses
Track authorization decisions at the API layer and alert on high volumes of cross-account object access
Review authentication logs for accounts exhibiting anomalous API call patterns following the disclosure date

How to Mitigate CVE-2026-94152

Immediate Actions Required

Restrict exposure of the /user/ endpoint to trusted networks until a vendor patch is available
Audit application logs for evidence of ID parameter manipulation targeting other user accounts
Contact Omega Solution directly to request a security update, given the reported lack of vendor response

Patch Information

No vendor patch has been published at the time of writing. The disclosure references note that the vendor did not respond to early notification. Monitor the VulDB CVE Entry and vendor communications for future updates.

Workarounds

Implement a reverse proxy or WAF rule that enforces session-to-ID binding on requests to /user/
Rate-limit requests to the User Profile API to slow enumeration attempts
Reduce the number of low-privilege accounts able to authenticate to the application until a fix is deployed

bash

# Example WAF rule concept (ModSecurity-style pseudocode)
# Deny requests to /user/ when the ID parameter does not match
# the authenticated session's user identifier stored in a header or cookie.
SecRule REQUEST_URI "@beginsWith /user/" \
  "chain,phase:2,deny,status:403,id:942100,msg:'IDOR guard for User Profile API'"
  SecRule ARGS:ID "!@streq %{SESSION.user_id}" "t:none"