Executive brief
Omega Solution HRM OS, a human resources management system, contains an access control vulnerability in its role permission endpoint that allows authenticated employees to view administrative roles and permissions they should not have access to. An attacker can modify a request parameter to retrieve confidential information about higher-level roles, such as administrator permissions, potentially exposing the system's authorization structure and enabling privilege escalation attacks. While the application still blocks actual administrative actions, the unauthorized disclosure of sensitive role configurations could facilitate further attacks.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) / Broken Access Control issue in the GET /role-permission/permission endpoint. An authenticated user can manipulate the roleId parameter to retrieve permission configurations for roles they should not access without server-side authorization checks. The endpoint returns permission sets for arbitrary roles to any authenticated attacker, allowing enumeration of the authorization structure, though backend routes still enforce access controls for actual administrative operations.
Affected products
- Omega Solution HRM OS up to 20260717
Timeline
- 2026-09-21: disclosed: Public disclosure via GitHub and NVD
- 2026-07-17: other: Vulnerability identified; vendor contacted but did not respond