Is CVE-2026-94149 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94149 being exploited in the wild.

How severe is CVE-2026-94149?

Medium severity, with a CVSS score of 4.3, published 21 September 2026.

Which products and versions are affected?

Omega Solution HRM OS up to 20260717.

Is there a fix for CVE-2026-94149?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-94149 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-94149?

Check whether you run Omega Solution HRM OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94149: Omega Solution HRM OS insecure direct object reference in role permission retrieval

CVE-2026-94149 · Severity: medium · CVSS 4.3 · Published 2026-09-21

Omega Solution HRM OS, a human resources management system, contains an access control vulnerability in its role permission endpoint that allows authenticated employees to view administrative roles and permissions they should not have access to. An attacker can modify a request parameter to retrieve confidential information about higher-level roles, such as administrator permissions, potentially exposing the system's authorization structure and enabling privilege escalation attacks. While the application still blocks actual administrative actions, the unauthorized disclosure of sensitive role configurations could facilitate further attacks.

Vendors: Omega Solution.

Quick answers

Is CVE-2026-94149 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94149 being exploited in the wild.
How severe is CVE-2026-94149?: Medium severity, with a CVSS score of 4.3, published 21 September 2026.
Which products and versions are affected?: Omega Solution HRM OS up to 20260717.
Is there a fix for CVE-2026-94149?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-94149 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-94149?: Check whether you run Omega Solution HRM OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) / Broken Access Control issue in the GET /role-permission/permission endpoint. An authenticated user can manipulate the roleId parameter to retrieve permission configurations for roles they should not access without server-side authorization checks. The endpoint returns permission sets for arbitrary roles to any authenticated attacker, allowing enumeration of the authorization structure, though backend routes still enforce access controls for actual administrative operations.

Affected products

Omega Solution HRM OS up to 20260717

Timeline

2026-09-21: disclosed: Public disclosure via GitHub and NVD
2026-07-17: other: Vulnerability identified; vendor contacted but did not respond

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.