CVE-2025-15563 PUBLISHED

Broken Access Control results in Denial of Service in NesterSoft WorkTime

Assigner: SEC-VLab
Reserved: 04.02.2026 Published: 19.02.2026 Updated: 19.02.2026

Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.

Product Status

Vendor NesterSoft Inc.
Product WorkTime (on-prem/cloud)
Versions Default: unknown
  • Version <= 11.8.8 is affected

Solutions

The vendor did not respond to our communication attempts anymore. It is currently as of February 2026 unclear, whether a patch is available. Please contact the vendor to request a patch for the identified critical security issues.

Credits

  • Tobias Niemann, SEC Consult Vulnerability Lab finder
  • Daniel Hirschberger, SEC Consult Vulnerability Lab finder
  • Thorger Jansen, SEC Consult Vulnerability Lab finder
  • Marius Renner, SEC Consult Vulnerability Lab finder

References

Problem Types

  • CWE-862 Missing Authorization CWE

Impacts

  • CAPEC-166 Force the System to Reset Values