TOKO-ONLINE-ROTI CVE-2026-15491

Q: What is the CVSS score of CVE-2026-15491?

CVE-2026-15491 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-43213 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-12 VulDB

GHSA-2w28-663r-qhcr

Authentication Bypass Toko Online Roti Rafymrx

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated access with low CIA impact and no scope change, directly mapping the CVSS 4.0 source vector to 3.1 equivalents.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 10:16 vuln.today

DescriptionCVE.org

A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Missing authentication in RafyMrX TOKO-ONLINE-ROTI, an Indonesian online bakery shop management application, allows remote unauthenticated attackers to access restricted application functionality with low-level impact across confidentiality, integrity, and availability. All code through commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 is affected, and no patch exists because the vendor did not respond to coordinated disclosure. No public exploit code and no CISA KEV listing exist at time of analysis.

Technical ContextAI

TOKO-ONLINE-ROTI (CPE: cpe:2.3:a:rafymrx:toko-online-roti:*:*:*:*:*:*:*:*) is a web-based point-of-sale or e-commerce management application for bakery businesses developed by RafyMrX. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning one or more application routes or controllers that should enforce authentication are reachable without credentials. The project operates on a rolling release model - no discrete version tags exist - with all code through commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 confirmed affected. The specific function or endpoint is not identified in the CVE description, which complicates targeted mitigation without direct source code inspection.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to the disclosure submitted to VulDB (https://vuldb.com/cve/CVE-2026-15491), and no patched commit or tagged release has been confirmed. Because the specific vulnerable endpoint is undisclosed, endpoint-level blocking is not possible without source code review. As the primary compensating control, operators should immediately place the application behind a VPN or firewall, restricting inbound access to trusted IP ranges only - this directly removes the AV:N attack surface. Operators with access to the source code should audit all routes and controllers for authentication middleware, manually enforcing session or token checks on any function that reads or modifies data. If the application is internet-facing and cannot be VPN-gated, taking it offline until a community or forked fix is available is the most conservative option given the vendor's unresponsiveness.