CVE-2026-94151 Details

A vulnerability exists in Omega Solution HRM OS versions prior to 20260717, specifically within the Role Permission API. The issue arises from a lack of authentication on the role permission retrieval endpoint, which can be accessed by any unauthenticated user. By manipulating the roleId parameter, an attacker can retrieve the complete set of permissions associated with a specified role. This vulnerability allows for the enumeration of privileged roles and the mapping of the application's authorization model, exposing sensitive information that should only be available to authenticated users.

Implement authentication and authorization checks on the role permission endpoint. Ensure that unauthenticated requests receive a 401 Unauthorized response, and that authenticated users only access permissions they are authorized to view.