{"id":"CVE-2026-79957","published":"2026-10-14T18:18:19.133","lastModified":"2026-10-16T21:19:53.860","description":"ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object","tags":[]},{"url":"https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}