Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-94152: Omega Solution FBP allows unauthorized access via User Profile API
CVE-2026-94152 · published 28 days ago
Summary
The User Profile API in Omega Solution FBP Fulfillment by People can be tricked into granting access to data without proper permission checks. This means an attacker could view or modify other users' information remotely. Apply any security updates from the vendor as soon as they are available and restrict access to the API until the issue is fixed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| omega solution | fbp fulfillment by people | 2025 |
Original advisory text
Omega Solution FBP Fulfillment by People User Profile API user authorization
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-285Improper Authorization
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta