CVE-2026-94151
MediumCVSS 5.3Summary
A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely, and the exploit has been made available to the public and could be used for attacks.
Risk Assessment
This could allow unauthorized users to access functions or data that require authentication.
Recommendation
Contact the vendor for a patch; until then, consider restricting API access and monitoring for unusual requests.
Other vulnerabilities in Omega Solution HRM OS
See all- CVE-2026-94150Low
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely, and the exploit has been released to the public and may be used for attacks.
- CVE-2026-94149Medium
A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource identifiers. The attack can be launched remotely, and the exploit is publicly available and might be used.
Original NVD description (English source)
A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.