Vulnerability Description
OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter. Any authenticated user, can read the Change Log containing actions performed by other users as well as application name of any application. This issue was fixed in OutSystems Lifetime version 11.28.2.3955
Related Weaknesses (CWE)
References
- https://cert.pl/en/posts/2026/05/CVE-2026-40126/
- https://success.outsystems.com/support/security/vulnerabilities/vulnerability_rp
- https://www.outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=
FAQ
What is CVE-2026-40127?
CVE-2026-40127 is a documented vulnerability. OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter. Any authenticated user, can read the Change Log containing actions perfo...
How severe is CVE-2026-40127?
CVSS scoring is not yet available for CVE-2026-40127. Check NVD for updates.
Is there a patch for CVE-2026-40127?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.