ServiceNext’s /api/Usuario/GetUsuarios endpoint allows an authenticated user to supply a numeric ID in the request body without confirming that the token belongs to the requested account, creating an IDOR flaw (CWE‑639). The flaw lets any authenticated user enumerate user IDs and retrieve the full profile of every other user, including passwords stored in cleartext (CWE‑256). This exposure enables immediate account takeover and credential‑stuffing attacks.

ServiceNext by SerTec is affected. No version information is disclosed in the advisory.

With a CVSS score of 8.1 the vulnerability is considered high severity. The EPSS score is not provided, and the vulnerability is not listed in CISA KEV. Attackers need only an authenticated token; iterating numeric IDs is trivial, so exploitation likelihood is high if the service is publicly accessible. The impact is full access to other users’ cleartext passwords, making exploitation potentially catastrophic.