CVE-2026-47094

SIMAC MyPHR 1.1 is vulnerable to an insecure direct object reference (IDOR, CWE-639) because the employee update endpoint does not validate server-side that the authenticated user owns the record being modified. Any authenticated user can send a PUT request to that endpoint with an arbitrary employee identifier and a password value they control, allowing them to change other employees' passwords and take over their accounts. The same flaw also permits enumeration of employee records and retrieval of sensitive personally identifiable information, including private pay bulletins. Organizations running SIMAC MyPHR 1.1 with multiple employee accounts are affected, with a low barrier to exploitation (network-accessible, low privileges, no user interaction per the 8.7 CVSS 4.0 score). No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

What to do: Contact the vendor for a patched release or an official fix, since no fixed version is stated in the available data. As an interim measure, audit application logs for PUT requests to the employee update endpoint referencing employee IDs other than the requester's own, and reset credentials for any accounts whose passwords may have been changed unexpectedly. Ensure employee accounts use strong, unique passwords to limit the impact of account takeover until server-side ownership validation is fixed.