Is CVE-2026-94152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94152 being exploited in the wild.

How severe is CVE-2026-94152?

Medium severity, with a CVSS score of 4.3, published 21 September 2026.

Which products and versions are affected?

Omega Solution FBP Fulfillment by People 2025.

Is there a fix for CVE-2026-94152?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-94152 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-94152?

Check whether you run Omega Solution FBP Fulfillment by People at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94152: Omega Solution FBP authorization bypass in User Profile API

CVE-2026-94152 · Severity: medium · CVSS 4.3 · Published 2026-09-21

Omega Solution's FBP (Fulfillment by People) platform contains an authorization flaw in its user profile API that allows authenticated attackers to view other users' private information. An attacker can modify a URL parameter to access arbitrary user accounts and retrieve sensitive personal data including names, email addresses, phone numbers, physical addresses, and account status without proper permission checks.

Vendors: Omega Solution.

Quick answers

Is CVE-2026-94152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94152 being exploited in the wild.
How severe is CVE-2026-94152?: Medium severity, with a CVSS score of 4.3, published 21 September 2026.
Which products and versions are affected?: Omega Solution FBP Fulfillment by People 2025.
Is there a fix for CVE-2026-94152?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-94152 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-94152?: Check whether you run Omega Solution FBP Fulfillment by People at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The User Profile API endpoint GET /user/{id} fails to validate whether an authenticated user has authorization to access the requested profile record. An attacker authenticated to the platform can enumerate or modify the {id} path parameter to retrieve data from any other user account. The vulnerability requires valid authentication credentials but no user interaction, and exposes confidential user information including PII.

Affected products

Omega Solution FBP Fulfillment by People 2025

Timeline

2026-07-17: disclosed
2026-09-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.