Is CVE-2026-79957 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-79957?

CVE-2026-79957 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-79957

Description

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.