---
id: CVE-2026-79957
title: >-
  ServiceNext contains an insecure direct object reference (IDOR) in the
  /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID
  in the request body without verifying that the authenticated token belongs to
  the reques…
summary: >-
  ServiceNext contains an insecure direct object reference (IDOR) in the
  /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID
  in the request body without verifying that the authenticated token belongs to
  the reques…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-639
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T18:18:19.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79957'
references:
  - url: >-
      https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object
    label: cves@blacklanternsecurity.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-14T18:47:39.316Z'
vendor: ServiceNext
product: SerTec
affected:
  - SerTec 1.00
---

## Overview

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.