ServiceNext 1.00 IDOR Flaw Exposes User Profiles and Cleartext Passwords

ServiceNext SerTec 1.00 contains an insecure direct object reference (IDOR) vulnerability in its API infrastructure. The flaw resides within the /api/Usuario/GetUsuarios endpoint, which fails to validate that the authenticated user requesting data is authorized to view the specific account targeted. This configuration error allows any authenticated user to access sensitive information belonging to other users within the same system instance, creating a significant risk for lateral movement and data exfiltration.

Root cause

The NVD record for CVE-2026-79957 identifies the core issue as a failure to verify ownership of the requested resource. The endpoint accepts a numeric ID in the request body, representing a specific user account. Instead of checking whether the authentication token presented by the requester corresponds to that specific ID, the application simply returns the associated profile data. This lack of authorization logic means the application trusts the input ID without validating the user’s permissions relative to that specific object, violating basic secure coding principles.

Attack path

An attacker with any valid login credential can exploit this vulnerability by manipulating the request sent to the /api/Usuario/GetUsuarios endpoint. By changing the numeric ID parameter in the request body, the attacker can iterate through possible user identifiers. For each ID tested, the server returns the full profile record of that user. This process allows the attacker to map out the entire user base of the organization, retrieving detailed profile information for every account accessible through this single API endpoint.

Affected versions

• ServiceNext SerTec 1.00

Mitigation

• No patch, fix, or update has been confirmed by the vendor for this vulnerability.
• Organizations should treat all authenticated access to this endpoint as potentially compromised.
• Review access logs for unusual patterns of user profile requests from single accounts.
• Consider disabling the endpoint if business continuity allows while awaiting a vendor response.

Signals worth monitoring

Security operations teams should monitor API access logs for high volumes of GET requests to user profile endpoints from single source IP addresses or user accounts. Look for sequences of sequential or rapidly changing numeric IDs in request bodies, which indicate automated enumeration attempts. Check for successful responses returning large amounts of personal data to accounts that typically do not require such access. Verify that authentication tokens are being validated against the requested resource owner in real-time. Investigate any alerts

What to do and how to stay safe

• Asset discovery is only the first step; context determines risk.
• Internal assets become external risks through cloud misconfigurations.
• Prioritization requires correlating vulnerability data with business criticality.

Attack surface management is continuous, contextual, and human-guided. Start by mapping your external assets and prioritizing risks based on business impact.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.