An insecure direct object reference vulnerability exists in the Fullstep registration flow. A logged‑in user can request data belonging to another user by manipulating the supplier ID in the API paths, enabling the retrieval or modification of that user’s personal details and documents. The flaw arises from missing authorization checks for the /api/suppliers/v1/suppliers/ endpoint and the supplier‑registration page, allowing an attacker to view or alter another account’s information. The weakness is a classic case of CWE‑639, where an application fails to enforce proper access‑control checks.

The issue affects Fullstep’s Fullstep product, specifically versions in the 5.x line. The vulnerability was fixed in version 5.30.07, which became available on January 29, 2026; all earlier 5.x releases remain affected.

The vulnerability carries a CVSS score of 7.6, indicating a high severity potential for data compromise. Exploitation requires the attacker to authenticate to the application, which is likely most common in internal or compromised environments. No public exploits are reported and the vulnerability is not listed in CISA’s KEV catalog, but the absence of EPSS data underscores that the exploitation probability is uncertain. Nonetheless, because the flaw grants an attacker access to sensitive user data, the risk warrants prompt remediation.