Executive brief
Ideagen Q-Pulse (now known as Ideagen Quality Management) is a platform used by organizations in regulated industries like healthcare and manufacturing to manage compliance, audits, and safety data. A security flaw in the user profile section allows any logged-in employee to view the personal details of any other user in the system, including full names, email addresses, job titles, and departments. This unauthorized access to the corporate directory could be used to facilitate targeted phishing or social engineering attacks against the organization.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the 'My Details' user profile functionality of Ideagen Q-Pulse version 7.1.0.32. The application uses a predictable 'objectKey' HTTP parameter to reference internal user identifiers without performing server-side authorization checks to verify if the requester owns the profile. An authenticated attacker can perform parameter tampering by incrementing or enumerating this key to retrieve sensitive information of other users, including full names, work emails, job titles, and departments. As of the advisory date, the vendor has reportedly been unresponsive, and no official patch is available. Security engineers are advised to implement server-side authorization checks and consider replacing sequential identifiers with UUIDs.
Affected products
- Ideagen Q-Pulse QMS (Quality Management System) 7.1.0.32
Timeline
- 2026-02-12: disclosed: Initial disclosure of CVE-2025-69752
- 2026-02-12: advisory: Public advisory released by brtsec via GitHub