Vulnerability · Published May 25, 2026 · Assigned by CERT-PL

CVE-2026-40127Authorization Bypass Through User-Controlled Key in OutSystems Lifetime

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in Lifetime from OutSystems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.5%top 57.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter. Any authenticated user, can read the Change Log containing actions performed by other users as well as application name of any application. This issue was fixed in OutSystems Lifetime version 11.28.2.3955

Affected products (as reported)

Vendor	Product	Versions
OutSystems	Lifetime	0 – before 11.28.2.3955

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/05/CVE-2026-40126/ third-party-advisory
https://www.outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=11&ComponentName=LifeTime product
https://success.outsystems.com/support/security/vulnerabilities/vulnerability_rpm_6441/ vendor-advisory