Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-47094SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in MyPHR from SIMAC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary employee identifier and a controlled password value to take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information including private pay bulletins.

Affected products (as reported)

Vendor	Product	Versions
SIMAC	MyPHR	1.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, exploit
Product Webpage product
https://www.vulncheck.com/advisories/simac-myphr-idor-account-takeover-via-api-employes-put-id third-party-advisory