Security readout for executives and security teams
Plain-English summary
An authenticated OutSystems LifeTime user can manipulate an application identifier to view other users’ Change Log activity and application names. The issue exposes limited management metadata rather than allowing modification or service disruption. OutSystems states that LifeTime 11.28.2.3955 fixes the vulnerability.
Executive priority
Schedule remediation in the normal near-term patch cycle, accelerating it for externally reachable management interfaces or environments with many low-trust users. The disclosed impact is limited confidentiality loss, but exposed application names and administrative activity may reveal operational intelligence useful for subsequent attacks.
Technical view
CVE-2026-40127 is a CWE-639 authorization bypass involving the user-controlled ApplicationID parameter. Insufficient object-level authorization permits any authenticated user to read Change Log entries and application names belonging to other applications. CVSS 4.0 rates it 5.3: network-accessible, low complexity, low privileges, no interaction, and limited confidentiality impact.
Likely exposure
Exposure is limited to organizations running affected OutSystems LifeTime deployments where authenticated users can reach the vulnerable functionality. The supplied sources do not define a complete affected-version range, so deployments below the fixed 11.28.2.3955 release require vendor-guidance review rather than assumptions about vulnerability status.
Exploitation context
The weakness requires an authenticated LifeTime account and targets confidentiality across application authorization boundaries. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public weaponized exploit. Internet reachability and broad account access could increase practical risk.
Researcher notes
The authorization decision appears to trust an ApplicationID supplied by an authenticated requester, matching CWE-639. Reported impact is read-only disclosure of Change Log actions and application names; integrity and availability impacts are not claimed. The source bundle does not establish complete vulnerable-version boundaries, technical root cause details, or exploitation in the wild.
Mitigation direction
- Upgrade OutSystems LifeTime to version 11.28.2.3955 or a vendor-approved later release.
- Restrict LifeTime access to trusted users and approved administrative networks until upgrading.
- Review vendor guidance for any deployment-specific prerequisites or additional remediation.
- Investigate unnecessary LifeTime accounts and revoke access where appropriate.
Validation and detection
- Inventory every LifeTime deployment and record its exact installed version.
- Confirm upgraded systems report version 11.28.2.3955 or a vendor-approved later release.
- Review access logs for unexpected Change Log or cross-application metadata access.
- Verify authenticated users can access only application records authorized for their roles.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-40127 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——CERT-PLVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://cert.pl/en/posts/2026/05/CVE-2026-40126/CVE reference, CERT-PL · third-party-advisory
- https://www.outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=11&ComponentName=LifeTimeCVE reference, CERT-PL · product
- https://success.outsystems.com/support/security/vulnerabilities/vulnerability_rpm_6441/CVE reference, CERT-PL · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.