CVE-2026-94149
MediumCVSS 4.3Summary
A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource identifiers. The attack can be launched remotely, and the exploit is publicly available and might be used.
Risk Assessment
An attacker can remotely exploit the vulnerability to gain access to unauthorized resources or information. The vendor did not respond to the disclosure, increasing the risk of no available patches.
Recommendation
Restrict access to the /role-permission/permission endpoint and monitor for unusual requests. Contact the vendor for information on available fixes or consider implementing compensating controls.
Other vulnerabilities in Omega Solution HRM OS
See all- CVE-2026-94151Medium
A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely, and the exploit has been made available to the public and could be used for attacks.
- CVE-2026-94150Low
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely, and the exploit has been released to the public and may be used for attacks.
Original NVD description (English source)
A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource identifiers. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.