Insecure Direct Object Reference in WEBCON BPS by WEBCON

CVE-2026-92419

What is CVE-2026-92419?

The WEBCON BPS software is exposed to an Insecure Direct Object Reference vulnerability within its Gantt vacation chart API. The issue arises from the 'selectedPeople' parameter in the /api/vacations/{path} endpoint, where the application fails to validate user authorization for accessing other users' vacation schedules. As a result, attackers with valid authentication can manipulate this parameter to gain unauthorized visibility into the scheduling data of employees across different departments, compromising the confidentiality of sensitive information. The vulnerability has been addressed in subsequent software updates.

References