OutSystems Lifetime has a flaw in the ApplicationID parameter that allows any authenticated user to bypass normal authorization checks and view the Change Log for any application. This log contains detailed information about actions performed by other users, exposing sensitive audit data and providing insight into user activity. The vulnerability is an Information‑Disclosure issue that could allow attackers to gain knowledge about system usage and potentially plan further attacks based on the disclosed information.

The issue affects the OutSystems Lifetime application. Versions older than 11.28.2.3955 are vulnerable. Users running earlier releases should verify their current version and plan an upgrade if necessary.

The CVSS score of 5.3 reflects a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the web interface or API when an authenticated user manipulates the ApplicationID parameter in a request. Because the attack requires authentication, the impact is limited to users who already have legitimate credentials, but the resulting information disclosure remains a security concern.