What is the CVSS score of CVE-2026-19081?

CVE-2026-19081 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-19081?

Yes, a patch is available for CVE-2026-19081. Update the affected software to the latest version immediately.

Gastromenum QR Menu System CVE-2026-19081

EUVD-2026-71104 MEDIUM

Missing Authorization (CWE-862)

2026-09-04 iletisim@usom.gov.tr

GHSA-wvh2-vj4m-3cwq

4.3

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable by any authenticated low-privilege account; only partial confidentiality impact - no integrity or availability consequence described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 04, 2026 - 15:17 EUVD

Metadata Corrected

Sep 04, 2026 - 14:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 04, 2026 - 14:30 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31.

AnalysisAI

Missing authorization in Gastromenum Ticket and QR Menu System (all versions before 2026.08.31) allows authenticated low-privileged users to access functionality and data that ACLs should restrict, leaking confidential information. The flaw was disclosed by Turkish USOM (iletisim@usom.gov.tr) and tracked under TR-26-1012. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid, authenticated session with at least low-privilege credentials (e.g., a staff or customer account on the platform - PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 4.3 (Medium) is consistent with a network-reachable, low-complexity missing authorization flaw that yields only limited confidentiality impact (C:L/I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Gastromenum Ticket and QR Menu System to version 2026.08.31 or later, which resolves the missing authorization issue per the vendor advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1012. … Detailed patch versions, workarounds, and compensating controls in full report.