{"id":"CVE-2026-79957","title":"ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the reques…","summary":"ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the reques…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-639"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T18:18:19.133","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79957","references":[{"url":"https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object","label":"cves@blacklanternsecurity.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-14T18:47:39.316Z","vendor":"ServiceNext","product":"SerTec","affected":["SerTec 1.00"],"slug":"CVE-2026-79957","body":"## Overview\n\nServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}