OutSystems vulnerabilities

🔔 Create alert RSS

Published CVEs affecting OutSystems products: 2 record(s), with severity, exploitation and fixes.

Platform Server 1 Lifetime 1

Exploited only (KEV) →

CVE-2026-40127 Medium · 5.3 CWE-639 May 25, 2026

Authorization Bypass Through User-Controlled Key in OutSystems Lifetime

OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter. Any authenticated user, can read the Change Log containing actions performed by other users as well as application name of any application. This issue was fixed in OutSystems Lifetime version 11.28.2.3955

CVE-2025-61258 High · 7.5 CWE-444 Dec 9, 2025

HTTP Request Smuggling in Outsystems Platform Server

Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length. NOTE: the Supplier indicates that they are unable to reproduce this.