CVE-2026-47094 is an IDOR vulnerability in SIMAC MyPHR 1.1 that enables authenticated attackers to bypass authorization by manipulating the employee update endpoint. The vulnerability arises from the lack of server-side validation of ownership, allowing attackers to specify arbitrary employee identifiers in PUT requests to update employee records. This can lead to account takeover, enumeration of employee records, and unauthorized access to sensitive personal data such as pay bulletins.

Exploitation of this vulnerability allows attackers with valid authentication to take over other employee accounts, enumerate employee records, and retrieve sensitive personally identifiable information including private pay bulletins. This poses a significant risk to confidentiality and integrity of employee data within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the employee update endpoint to trusted users only and monitor for suspicious activity involving modification of employee records.