Executive brief
SIMAC MyPHR is a human resources management platform used by organizations to manage employee data, payroll, and personnel records. An authentication bypass flaw allows any authenticated employee to view and modify other employees' personal information, financial records, and passwords—enabling account takeover and unauthorized access to sensitive data across the entire organization.
Technical details
The vulnerability is an insecure direct object reference (IDOR, CWE-639) in the MyPHR API endpoints that lack server-side ownership validation. An authenticated attacker can manipulate resource identifiers in requests to `/api/employes/[ID]`, `/api/bulletinPaie/getByEmpyPeriode/[ID]/[ID]`, and other endpoints to access and modify arbitrary employee records. The application fails to verify that the requesting user owns or has permission to access the target resource, allowing enumeration of all employee profiles, retrieval of sensitive PII and pay bulletins, and password modification via PUT requests to execute full account takeover. The vulnerability requires valid authentication credentials but no additional user interaction, making it exploitable by any legitimate user within the organization.
Affected products
- SIMAC MyPHR 1.1
Timeline
- 2026-09-16: disclosed: CVE-2026-47094 published