PT-2026-43032 · Outsystems · Outsystems Lifetime

Zbigniew Piotrak · Published 2026-05-25 · Updated 2026-05-25 · CVE-2026-40127

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OutSystems Lifetime versions prior to 11.28.2.3955

Description An authorization bypass exists due to a user-controlled key in the ApplicationID parameter. This allows any authenticated user to read the Change Log, which contains the application names and actions performed by other users.

Recommendations Update to version 11.28.2.3955. Restrict use of the ApplicationID parameter to authorized personnel only until the update is applied.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-40127

Affected Products

Outsystems Lifetime

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-40127 · Security Note
• https://cert.pl/en/posts/2026/05/CVE-2026-40126 · Note
• https://twitter.com/CVEnew/status/2058935260419613161 · Twitter Post
• https://t.me/CVEtracker/54854 · Telegram Post
• https://outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=11&ComponentName=LifeTime · Note