{"id":"CVE-2026-79957","revision":"0fecfe15f2774ff48d87a290c54cf76b","records":[{"revision":"0fecfe15f2774ff48d87a290c54cf76b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-79957","aliases":[],"title":"ServiceNext Insecure Direct Object Reference via GetUsarios","description":"ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.","state":0,"publishedAt":"2026-10-14T18:01:51.493+00:00","modifiedAt":"2026-10-16T20:15:51.18+00:00","affected":[{"ecosystem":"Vendor product","name":"SerTec","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ServiceNext\",\n                    \"product\": \"SerTec\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.00\",\n                            \"versionType\": \"SerTec\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1,"severity":"HIGH"}],"references":["https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-79957","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-79957","identifiers":["CVE-2026-79957"]},"retained":false,"historicalAffected":[]}],"coverage":[]}