An Authorization Bypass Through User-Controlled Key / Insecure Direct Object Reference (IDOR) vulnerability (CWE-639) was identified in Zucchetti Helpdesk Advanced (HDA) 11.2. The application relies on user-supplied identifiers (such as sequential numeric parameters within URL path variables) to access and retrieve resources without adequately validating whether the requesting user possesses the authorization to access the specific object instance. Impact:
An authenticated attacker can systematically enumerate and exfiltrate sensitive data across the entire platform by incrementing or manipulating identifier parameters in URL paths. This permits unauthorized horizontal and vertical access to platform-wide records, including:
Upgrade to the latest software release provided by the vendor to ensure server-side object-level access controls (OBAC) and resource ownership validations are strictly enforced on all parameterized endpoints.