EUVD-2026-45204
GHSA-7grq-v3mc-cv46
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable IDOR requiring only an authenticated low-privilege session; confidentiality-only impact with no integrity or availability consequence.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows Exploitation of Trusted Identifiers.
This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
AnalysisAI
Authorization bypass in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows an authenticated low-privileged user to access confidential data belonging to other users by manipulating user-controlled identifier keys in requests. The flaw (CWE-639, IDOR class) exposes high-confidentiality data without requiring elevated privileges or user interaction, over the network. No public exploit or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Turkey's national CERT (TR-CERT) via advisory TR-26-0573.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) is the classic Insecure Direct Object Reference (IDOR) vulnerability class. The affected product - GisLab Laboratory Management System, identified via CPE cpe:2.3:a:gis_informatics_engineering_consulting_laboratory_r&d_and_software_services_inc.:gislab_laboratory_management_system - fails to verify server-side that a requesting user is authorized to access the resource identified by a key they supply (e.g., a record ID, user identifier, or token in a URL parameter or request body). Because the application trusts the caller-supplied key without binding it to the authenticated session's ownership context, a low-privileged authenticated user can enumerate or substitute keys to retrieve records belonging to other users. This affects all versions from 1.4.03 through the 08072026 build. The system appears to be a laboratory management platform, meaning the data at risk likely includes sensitive laboratory records, test results, or personnel information.
RemediationAI
Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0573 for vendor-released patch guidance, as an exact fixed version was not independently confirmed in the available intelligence. No vendor-released patch version is confirmed by the current data. If a patched version has been released by the vendor, upgrade immediately. As a compensating control while awaiting a patch, restrict access to the laboratory management system to only trusted internal network segments by firewall or VPN - this raises the bar for an attacker to obtain a valid authenticated session. Additionally, implement server-side access control validation that binds resource lookups to the authenticated session's user identity, preventing key substitution attacks. Audit application logs for anomalous patterns of sequential or cross-user record access by individual accounts, which may indicate active exploitation. Note that network restriction does not remediate the IDOR flaw and should be treated as a temporary mitigating measure only.
SQL injection in GIS Informatics GisLab Laboratory Management System (versions 1.4.03 up to but not including 1.5) allow
SQL injection in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows remote unauthenticated at
Unauthenticated path traversal in GisLab Laboratory Management System (versions 1.4.03 through before 1.5) allows remote
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today