Insecure Direct Object Reference in BOLD Workplanner by BOLD

CVE-2025-41097

What is CVE-2025-41097?

The BOLD Workplanner has a vulnerability that allows authenticated users to exploit Insecure Direct Object Reference (IDOR). This arises from insufficient validation of user input, permitting unauthorized access to sensitive employee information through internal identifiers. As a result, users may inadvertently gain visibility into data that should be restricted, posing risks to data integrity and confidentiality.

References