ServiceNext SerTec: Insecure direct object reference in user retrieval endpoint
Summary
ServiceNext SerTec version 1.00 contains an insecure direct object reference in the GetUsuarios API endpoint. An authenticated user can change a numeric ID in the request body to retrieve the profile of any other user, including the cleartext password, username, recovery email and partner company. Enumerating sequential IDs can expose all accounts, enabling account takeover and credential stuffing against other services.
Affected
- ServiceNext SerTec version 1.00 (as named in the CVE record)
- Whether later versions are affected: Unknown.
Fixed in
- Vendor acknowledged the report and released a fixed version in August 2026 (per the researcher's blog). The fixed version number: Unknown.
Workaround
- None documented. Unknown.
- Restricting access to the endpoint or network-level controls are not confirmed by the vendor and must be verified with ServiceNext before use.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: no, technical impact: total.
- Not listed in CISA KEV. EPSS about 0.003.
- No in-the-wild exploitation known.
Our recommendation
- Confirm whether you use ServiceNext SerTec and which version.
- Ask ServiceNext in writing for the fixed version number and confirmation that the fix is deployed to your tenant.
- Assume passwords were exposed before the fix: force password resets for all users and check for reuse on other services.
- Review access logs for unusual requests to /api/Usuario/GetUsuarios before the fix date, if logs exist.
- Enforce MFA where supported and review partner and workshop accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Black Lantern Security: CVE-2026-79957 Insecure Direct Object Reference in ServiceNext blog.blacklanternsecurity.com
- VulDB entry 420292 vuldb.com
- Vulners VULNRICHMENT: CVE-2026-79957 vulners.com
- OpenCVE: CVE-2026-79957 app.opencve.io
- CVE record via threatint aggregator cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:05.
Original description (NVD)
ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.