CVE-2026-94151

5.3 MEDIUMpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: A vulnerability allows for missing authentication by manipulating the argument roleId in the Role Permission API's /role-permission/permission endpoint, posing a risk to system security.
Exploitability: Exploitation requires knowledge of the specific argument manipulation and access to the affected API endpoint. Publicly available exploits exist.
Blast radius: If exploited, this could lead to unauthorized access or actions within the HRM OS system, impacting data integrity and confidentiality.
Prioritized remediation: Update to the latest version of Omega Solution HRM OS if available; otherwise, apply vendor-provided patches immediately.

auth-bypassapiweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-287, CWE-306

Public exploit & PoC references

https://github.com/4m3rr0r/PoCVulDb/issues/22

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.