What is the CVSS score of CVE-2026-12693?

CVE-2026-12693 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Enterprise Video Platform are affected by CVE-2026-12693?

Vimesoft Enterprise Video Platform versions 3.11.0.0 through 3.24.x contain a critical authorization bypass (CVE-2026-12693, CVSS 9.4) that allows unauthenticated remote attackers to access and…. A patch is available.

How to fix or mitigate CVE-2026-12693?

Within 24 hours, identify and document all Vimesoft Enterprise Video Platform instances running versions 3.11.0.0 through 3.24.x, implement network-level access restrictions to limit platform exposure, and enable enhanced API logging to detect unauthorized cross-tenant access. Within 7 days, deploy a Web Application Firewall (WAF) with rules to detect IDOR-style authorization bypass attempts, implement API rate limiting, and establish direct contact with Vimesoft to confirm patch availability and upgrade timeline to version 3.25.0 or later. Within 30 days, execute the upgrade to Vimesoft Enterprise Video Platform 3.25.0 or later, conduct post-upgrade validation of authorization controls across tenants, and perform forensic review of access logs for signs of exploitation.

Enterprise Video Platform CVE-2026-12693

EUVD-2026-45227 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-17 iletisim@usom.gov.tr

GHSA-qfhx-9988-86x5

Authentication Bypass

9.4

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

9.4 CRITICAL

Network-reachable IDOR needing no auth or interaction (AV:N/AC:L/PR:N/UI:N); user-controlled key exposes and alters other users' data (C:H/I:H) with limited availability effect (A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 17, 2026 - 19:18 EUVD

Analysis Generated

Jul 17, 2026 - 17:30 vuln.today

CVE Published

Jul 17, 2026 - 17:17 nvd

CRITICAL 9.4

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

AnalysisAI

Authorization bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets remote unauthenticated attackers manipulate a user-controlled key (an IDOR-style reference) to reach functionality that should be restricted by access-control lists. Reported to Turkey's national CSIRT (USOM) with a CVSS 9.4, it enables reading and altering other tenants'/users' resources; no public exploit identified at time of analysis and the flaw is not in CISA KEV.

Technical ContextAI

The platform is an enterprise video conferencing/streaming solution from the Turkish vendor Vimesoft. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference: the application uses a client-supplied identifier (e.g., a session, meeting, stream, recording, or user ID passed in a request) to select resources or actions but fails to verify that the requesting principal is actually authorized for that object. Because the ACL check is missing or applied after object selection, changing the key value in the request grants access to functionality and data belonging to other users. No CPE strings were provided in the input, so exact platform/component identification beyond the product and version range is not available.

RemediationAI

Upgrade Enterprise Video Platform to version 3.25.0 or later, which is the first release outside the affected range per the NVD version data (Patch available per vendor advisory; consult TR-26-0574 at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0574 and confirm the exact fixed build with Vimesoft before deployment). If patching cannot be done immediately, restrict network exposure by placing the platform behind a VPN or IP allow-list so it is not internet-reachable, and add server-side authorization checks or a WAF/reverse-proxy rule that validates that the authenticated principal owns any user-, meeting-, stream-, or recording-identifier passed in requests - accepting that WAF pattern matching on object IDs is brittle and may break legitimate multi-tenant access. Enable and monitor access logs for requests that iterate or tamper with object identifiers. These compensating controls reduce exposure but do not close the underlying IDOR, so upgrading remains the primary fix.