Medium severityNVD Advisory· Published May 25, 2026· Updated May 26, 2026
CVE-2026-40127
CVE-2026-40127
Description
OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter. Any authenticated user, can read the Change Log containing actions performed by other users as well as application name of any application.
This issue was fixed in OutSystems Lifetime version 11.28.2.3955
Affected products
1- Range: <11.28.2.3955
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.