Description

SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary employee identifier and a controlled password value to take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information including private pay bulletins.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-16T18:17:09.323Z",
  "pubdate": "2026-09-16T18:17:09.323Z",
  "executiveSummary": "SIMAC MyPHR version 1.1 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability resulting from insufficient server-side authorization controls. The flaw resides within the employee record update mechanism, which fails to validate whether the authenticated user possesses the appropriate permissions to modify the targeted record.\nThis vulnerability allows an authenticated attacker to perform unauthorized account takeovers, enumerate sensitive employee data, and exfiltrate personally identifiable information (PII), including private pay bulletins. By manipulating the employee identifier in a PUT request, an attacker can modify target account details, effectively gaining full control over arbitrary user profiles. The risk implications are severe, as the vulnerability compromises the confidentiality and integrity of sensitive corporate human resources data. Exploitation requires an authenticated session within the application, but it does not necessitate administrative privileges, making it accessible to any standard authenticated user.",
  "technicalDetails": "The vulnerability is rooted in the failure of the server-side logic to perform proper access control checks during object reference requests. When interacting with the employee update endpoint, the application relies exclusively on user-supplied input to identify the resource being modified without validating the ownership or authorization status of the session relative to the requested object identifier.\nThe attack flow proceeds as follows: 1) An attacker authenticates to the SIMAC MyPHR 1.1 platform using valid, low-privileged credentials. 2) The attacker intercepts or crafts a PUT request directed at the employee update endpoint, identifying the target employee record through an arbitrary identifier (e.g., an employee ID or URI parameter). 3) By supplying a modified payload within the PUT request—specifically including a controlled password value—the attacker forces the backend to update the target account credentials.\nBecause the server-side code does not perform a secondary validation to confirm that the session token linked to the requestor corresponds to the owner of the target employee ID, the system processes the request as legitimate. This allows for horizontal privilege escalation, enabling the attacker to set new passwords for arbitrary accounts, thereby performing a full account takeover.\nBeyond account takeover, the vulnerability enables unauthorized enumeration of the system. By systematically iterating through employee identifiers in the PUT or GET request parameters, an attacker can harvest PII from the entire employee database. The exposed data includes sensitive documentation, specifically private pay bulletins, which are retrieved and exfiltrated through the same flawed endpoint. The lack of server-side ownership validation effectively bypasses the application's intended security boundary, granting any authenticated user the ability to bypass privacy protections and modify data across the user base.\nThis issue is present in SIMAC MyPHR 1.1. The vulnerability is highly exploitable via common interception proxies, allowing for automated scripting to traverse the full scope of employee records, leading to a widespread data breach of HR-related infrastructure."
}