What is the CVSS score of CVE-2025-1031?

CVE-2025-1031 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of SoliClub are affected by CVE-2025-1031?

Utarit Informatics SoliClub Android application versions 5.2.4-5.3.6 contain an unauthenticated authorization bypass (IDOR) allowing remote attackers to access and manipulate other users' data…

How to fix or mitigate CVE-2025-1031?

Within 24 hours: Inventory all production SoliClub instances running versions 5.2.4-5.3.6; audit access logs for unauthorized user data queries. Within 7 days: Deploy API gateway rules to validate authorization on every user-ID parameter and enforce strict data access controls; enable real-time alerting on failed authorization attempts. Within 30 days: Obtain explicit timeline from Utarit Informatics for security patch release; evaluate application replacement if no patch is committed within 90 days.

SoliClub CVE-2025-1031

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2025-12-18 iletisim@usom.gov.tr

Authentication Bypass Soliclub

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 08:32 vuln.today

CVE Published

Dec 18, 2025 - 15:15 nvd

HIGH 7.5

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc. SoliClub allows Functionality Misuse.

This issue affects SoliClub: from 5.2.4 before 5.3.7.

AnalysisAI

Authorization bypass in Utarit Informatics SoliClub Android application versions 5.2.4 through 5.3.6 allows remote unauthenticated attackers to access or manipulate other users' data by tampering with user-controlled identifiers (IDOR). The flaw enables functionality misuse with high impact on confidentiality (CVSS 7.5), though no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.04%.

Technical ContextAI

The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference (IDOR). According to the CPE (cpe:2.3:a:utarit:soliclub:*:*:*:*:*:android:*:*), the affected component is the SoliClub Android mobile application developed by Utarit Informatics Services Inc., a Turkish vendor. In this class of weakness, server-side endpoints accept an identifier (such as a user ID, account number, or resource ID) supplied by the client and use it to look up or operate on data without verifying that the authenticated requestor is authorized for that specific object, allowing horizontal privilege escalation between accounts.

RemediationAI

Vendor-released patch: upgrade SoliClub for Android to version 5.3.7 or later, which is the first fixed release per the NVD version range. Refer to the USOM advisory at https://www.usom.gov.tr/bildirim/tr-25-0466 and https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0466 for vendor confirmation. As compensating controls pending mandatory app updates, operators of the backend API should enforce server-side authorization checks that bind every object lookup to the authenticated session's identity rather than trusting client-supplied IDs, and consider rate-limiting or monitoring sequential-ID enumeration patterns at the API gateway; the trade-off of enumeration rate limits is potential false positives for legitimate bulk activity by power users.