WEBCON BPS Updates Fix Vacation-Data Authorization Bypass
Tech GuruQuick Answer
WEBCON BPS can expose employees' vacation schedules to authenticated users who should not see them. The affected vacation API checks the selected people inadequately. The listed fixes are 2025.2.1.177 and 2026.1.1.20; select the supported upgrade path for your installed branch.
Confirm Scope And Apply The Supported Fix
Next step: Check the BPS build and who can reach the vacation-chart API. Install the applicable fix and validate access rules with synthetic employee accounts from different teams or offices.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | WEBCON BPS 2024.1.1.145 before 2025.2.1.177 and 2026.1.1.1 before 2026.1.1.20 |
|---|---|
| Advisory | CVE-2026-92419 |
| CVE | CVE-2026-92419 |
| Authoritative release date | 2026-09-23 14:41:08.125 UTC |
| Authority revision date | 2026-09-23 15:20:11.492 UTC |
| Affected versions | WEBCON BPS 2024.1.1.145 before 2025.2.1.177 and 2026.1.1.1 before 2026.1.1.20 |
| Fixed version | WEBCON BPS 2025.2.1.177 or 2026.1.1.20 |
| CVSS base score | 5.3 (CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
This is an insecure direct object reference, or IDOR: supplying a different person's identifier can return their data without a corresponding permission check. A login is required, but being logged in should not authorize access to another employee's schedule.
What To Validate Now
- Inventory. Locate WEBCON BPS 2024.1.1.145 before 2025.2.1.177 and 2026.1.1.1 before 2026.1.1.20 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: WEBCON BPS 2024.1.1.145 before 2025.2.1.177 and 2026.1.1.1 before 2026.1.1.20 Do not infer applicability from product family or severity alone.
- Remediate. Apply WEBCON BPS 2025.2.1.177 or 2026.1.1.20 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Using approved test accounts, verify allowed access to an authorized schedule and denied access across a restricted team boundary. Test both the chart and its API. Do not collect real colleagues' vacation data as proof; retain sanitized results and handle suspected exposure through the privacy-response process.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
