CVE-2026-94149 Details

A broken access control vulnerability has been identified in Omega Solution HRM OS versions prior to 20260717. The issue resides in the role permission retrieval endpoint, which improperly validates user authorization for accessing permissions of different roles. This flaw allows authenticated low-privileged users to access and enumerate the permission sets of higher-privileged roles, including administrators, by manipulating the roleId parameter in the request. Although the backend correctly enforces authorization for protected admin routes, the unauthorized access to role permissions itself constitutes a significant security risk.

Implement object-level authorization checks before returning role permission information. Verify that the authenticated user is authorized to access the requested role and do not rely on client-supplied roleId values. Enforce server-side authorization for all role permission requests and return a 403 Forbidden response when a user requests permissions for roles they do not own or are not allowed to access.