What is the CVSS score of CVE-2026-10711?

CVE-2026-10711 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of CafePlus are affected by CVE-2026-10711?

AKIN Software CafePlus versions 12.05.03 through 12.05.04 contain a missing authentication vulnerability allowing adjacent network attackers to bypass access controls and fully compromise system…. A patch is available.

How to fix or mitigate CVE-2026-10711?

24 hours: Identify all systems running CafePlus 12.05.03-12.05.04; implement immediate network segmentation and firewall rules to restrict adjacent network access to these systems. 7 days: Contact AKIN Software to determine patched version availability and timeline; assess whether upgrade, replacement, or decommissioning is feasible for your environment. 30 days: Complete patching, migration, or decommissioning of all affected instances; document compensating network controls if any systems remain unpatched.

CafePlus CVE-2026-10711

EUVD-2026-38426 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-23 TR-CERT

GHSA-72hx-6mcj-jmr2

Authentication Bypass Cafeplus Akin Software Computer Import Export Industry And Trade Ltd

8.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent-network reachable, no auth or interaction, low complexity, and missing ACL on a critical function yields full C/I/A impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 23, 2026 - 14:17 EUVD

Analysis Generated

Jun 23, 2026 - 13:00 vuln.today

DescriptionCVE.org

Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects CafePlus: from 12.05.03 before 12.05.04.

AnalysisAI

Missing authentication in AKIN Software's CafePlus versions 12.05.03 through 12.05.04 allows adjacent-network attackers to access privileged functionality without credentials. The flaw enables full compromise of confidentiality, integrity, and availability over an adjacent network vector, with no public exploit identified at time of analysis. Reported by Turkey's national CERT (TR-CERT), the issue stems from critical functions lacking proper ACL enforcement.

Technical ContextAI

CafePlus is a point-of-sale and management platform produced by AKIN Software Computer Import Export Industry and Trade Ltd., commonly deployed in Turkish cafe and hospitality environments. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning one or more sensitive operations are exposed without verifying caller identity. Per the CPE 'cpe:2.3:a:akin_software_computer_import_export_industry_and_trade_ltd.:cafeplus', the flaw lives in the application layer, and the CVSS adjacent-network vector (AV:A) implies the exposed function is reachable over LAN/Wi-Fi rather than the public internet, consistent with a thick-client or LAN service architecture typical of POS suites.

RemediationAI

Upgrade CafePlus to version 12.05.04 or later, which the advisory metadata indicates is the fixed release; confirm availability and patch notes via the vendor through the TR-CERT bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0428. Until patched, segment CafePlus servers and terminals onto a dedicated management VLAN isolated from guest Wi-Fi and untrusted staff devices to neutralize the adjacent-network vector (trade-off: requires switch/AP capable of VLAN tagging and may break ad-hoc tablet ordering setups). Additionally, restrict access to CafePlus listening ports with host-based firewall rules permitting only known POS terminal IPs (trade-off: breaks dynamic DHCP terminal deployments) and monitor LAN traffic for anomalous connections to the CafePlus service.