Fullstep V5 Insecure Direct Object Reference Vulnerability

A vulnerability allowing insecure direct object reference (IDOR) has been identified in the Fullstep V5 registration process. This vulnerability allows authenticated users to access data belonging to other registered users through various authenticated resources in the application. The issue arises in endpoints that list user information and those that allow users to update their personal details and documents.

Impact

Exploitation of this vulnerability could lead to unauthorized access to and modification of other users' data.

Remediation

The vulnerability has been fixed in Fullstep version 5.30.07, which has been available in production since January 29, 2026.