Vulnerability · Published Oct 14, 2026 · Assigned by BLSOPS

CVE-2026-79957ServiceNext Insecure Direct Object Reference via GetUsarios

High 8.1

In plain English

A high-severity authorization bypass via user-controlled key in SerTec from ServiceNext. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 76.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

Affected products (as reported)

Vendor	Product	Versions
ServiceNext	SerTec	1.00

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Insecure Direct Object Reference in ServiceNext third-party-advisory