OutSystems LifeTime IDOR Vulnerability Advisory (CVE-2026-40127)

Vulnerability Overview Vulnerability Name: Vulnerability RPM-6441 Security Advisory ID: RPM-6441 Initial Release Date: May 30, 2026 Public Disclosure Date: May 30, 2026 Status: Publicly Disclosed Workaround: None OutSystems Bug ID: RPM-6441 CVSS Score: Medium 4.3 CVE ID: CVE-2026-40127 Impact Scope Affected Products: All versions of OutSystems 11 LifeTime up to version 11.28.2. Vulnerability Details: The application's changelog endpoint lacks fine-grained authorization, leading to an Insecure Direct Object Reference (IDOR) vulnerability. Although the system validates authentication, it does not verify whether the user has the specific permissions required to view the requested changelog. Consequently, any valid account can access the changelog by manipulating the parameter. Furthermore, the use of sequential, predictable identifiers as the parameter enables the systematic retrieval of changelogs for all applications in the environment through automated parameter iteration. Remediation Workaround: Customers are advised to update LifeTime to the latest version: - OutSystems 11 Cloud: OutSystems is upgrading all infrastructure in O11 Cloud as part of the Windows Server 2022 upgrade, which will upgrade all LifeTime instances to a version that resolves this vulnerability. No action is required. - OutSystems 11 Self-Managed: Update LifeTime to the latest version. Fixed Products and Versions: OutSystems has released LifeTime version 11.28.2, which resolves this vulnerability. All subsequent versions are protected. If you operate a self-managed infrastructure, we strongly recommend upgrading to the latest version. Frequently Asked Questions (FAQ) Can an attacker access my data by exploiting this vulnerability? - Yes, but only to a very limited extent. Only the application's changelog data is readable by authenticated users within the system. Is this vulnerability being exploited in the wild? - OutSystems has no evidence that this vulnerability is being exploited in the wild, and no customers have been affected. What do I need to do? - Update your OutSystems Platform to the versions mentioned above. For OutSystems Cloud, the upgrade is currently in progress. Will OutSystems share more information about this vulnerability? - To protect its customers, OutSystems will not provide further details regarding this vulnerability. Who can I contact to discuss this issue? - If you have any questions, please contact your Customer Success Manager. If you do not have one, please reach out to us through our support channels.

Goal Reached Thanks to every supporter — we hit 100%!

OutSystems LifeTime IDOR Vulnerability Advisory (CVE-2026-40127)