Affected Systems

WEBCON BPS versions 2024.1.1.145 through 2025.2.1.176 and 2026.1.1.1 through 2026.1.1.19. The vulnerability affects the /api/vacations/{path} endpoint, specifically the Gantt vacation chart API's selectedPeople parameter.

Exploitation Status

No public PoC or active exploitation reported. Vulnerability was responsibly disclosed to CERT Polska and coordinated with vendor. Exploitation requires authenticated access but is straightforward via API parameter manipulation.

Business Impact

Authenticated attackers can enumerate and view vacation schedules of any employee across the organization, including executives and staff in other departments or offices, bypassing intended business logic access controls. This exposes sensitive workforce availability data that could be used for social engineering, competitive intelligence, or planning physical security attacks. Organizations using WEBCON BPS for HR workflow management should assume vacation data confidentiality has been compromised if unauthorized access occurred.

Urgency

đźź  Within 24 hours

Recommended Actions

  • Upgrade WEBCON BPS to version 2025.2.1.177 or 2026.1.1.20 immediately
  • Review API access logs for /api/vacations/ endpoint to identify suspicious selectedPeople parameter usage with user logins outside normal access patterns
  • Audit user accounts with access to WEBCON BPS for legitimacy and disable any unnecessary authenticated accounts
  • Implement network segmentation or WAF rules to restrict /api/vacations/ endpoint access to authorized IP ranges until patching is complete
  • Notify HR and security teams of potential vacation data exposure for affected time periods

---

# Geopolitical Context

Geopolitical Context

This disclosure represents a routine coordinated vulnerability disclosure (CVD) process managed by CERT Polska, Poland's national computer emergency response team. WEBCON BPS is a business process management and workflow automation platform developed by Polish software vendor WEBCON, serving primarily enterprise clients in Central and Eastern Europe. The vulnerability (CVE-2026-92419) is an Insecure Direct Object Reference (IDOR) flaw allowing authenticated attackers to bypass authorization controls and access employee vacation scheduling data across organizational boundaries. The issue was responsibly reported to CERT Polska, coordinated with the vendor, and patched prior to public disclosure—consistent with established norms in the European cybersecurity ecosystem. No evidence suggests exploitation in the wild or state-sponsored interest; this appears to be a standard software security issue affecting a regional enterprise platform.

State Actor Alignment

No state actor involvement is indicated. This is a commercially developed software vulnerability disclosed through Poland's national CERT coordination process. WEBCON is a private Polish software company, and the flaw was identified and reported by an independent security researcher (Robert Strzoda). The disclosure follows standard CVD protocols and does not appear connected to intelligence collection, sanctions evasion, or state-sponsored cyber operations. Poland, as a NATO and EU member state, maintains mature cybersecurity institutions and adheres to Western norms on vulnerability disclosure and software security.

Business Impacty pro region

The vulnerability's impact is primarily confined to organizations using WEBCON BPS, which has market presence in Poland and neighboring Central European states. Given the platform's role in enterprise workflow management, affected organizations may include government agencies, financial institutions, and critical infrastructure operators in the region. The disclosure underscores the importance of secure software development practices among regional vendors serving sensitive sectors. For the broader European cybersecurity community, this case exemplifies effective national CERT coordination and responsible disclosure norms. Organizations outside Poland using WEBCON BPS—particularly multinational enterprises with operations in Central Europe—should prioritize patching to versions 2025.2.1.177 or 2026.1.1.20. The incident does not appear to carry broader geopolitical ramifications beyond routine enterprise security hygiene.

Forecast

If organizations delay patching, opportunistic threat actors may exploit CVE-2026-92419 to conduct reconnaissance against enterprises using WEBCON BPS, potentially mapping organizational hierarchies and employee schedules to support social engineering or physical security attacks. If proof-of-concept code becomes publicly available, exploitation attempts are likely to increase within weeks. However, given the vulnerability requires authenticated access and targets a regionally deployed platform, widespread exploitation appears unlikely. If WEBCON maintains responsive patch deployment and CERT Polska continues active coordination, the incident is expected to remain contained within normal enterprise risk management channels without escalating into a significant regional cyber event.