IDOR Vulnerability in SIMAC MyPHR

SIMAC MyPHR version 1.1 contains an Insecure Direct Object Reference (IDOR) vulnerability, tracked as CVE-2026-47094. The vulnerability arises from missing server-side ownership validation, which allows an authenticated attacker to manipulate records belonging to other users. By crafting specific HTTP requests, an attacker can enumerate employee records, access sensitive personally identifiable information (PII) including private pay bulletins, and perform unauthorized account takeovers. Because the flaw lies in the backend access control logic, the impact is significant for organizations relying on this software to manage employee data. Defenders should prioritize updating instances of MyPHR and investigate application logs for unusual patterns of sequential ID access.

Impact

Successful exploitation allows for unauthorized access to sensitive employee PII and the potential for account takeover. This exposure threatens the confidentiality and integrity of human resources data, potentially leading to identity theft or financial fraud involving pay records.

Recommendation

• Upgrade all instances of SIMAC MyPHR to a patched version once released by the vendor.
• Monitor web application logs for high volumes of PUT requests targeting sequential or unauthorized employee identifiers.
• Implement stricter access controls at the API gateway level to validate ownership of requested resource IDs before forwarding requests to the MyPHR backend.