CVE-2026-40127 is an authorization bypass vulnerability in OutSystems Lifetime caused by improper validation of the ApplicationID parameter. This allows any authenticated user to access Change Log data belonging to other users, exposing potentially sensitive operational information. The vulnerability corresponds to CWE-639 (Authorization Bypass Through User-Controlled Key). The vendor fixed the issue in OutSystems Lifetime version 11.28.2.3955.

Exploitation of this vulnerability allows authenticated users to read Change Log entries of other users, revealing actions performed and application names. This could lead to unauthorized disclosure of operational details within the OutSystems environment. There is no indication of privilege escalation or remote unauthenticated access. No known active exploitation has been reported.

Upgrade OutSystems Lifetime to version 11.28.2.3955 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in this version, applying this update is the recommended remediation. No additional mitigations are specified or required.