What is the CVSS score of CVE-2026-2346?

CVE-2026-2346 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Menulux Mobile App are affected by CVE-2026-2346?

A critical authorization bypass vulnerability (CVE-2026-2346, CVSS 9.8) in Menulux Software Inc.

How to fix or mitigate CVE-2026-2346?

Within 24 hours, complete a full inventory of Menulux Software Inc. Mobile App instances in production and identify the specific builds deployed to quantify exposure scope; initiate preliminary risk assessment to determine which user data categories could be accessed via this IDOR vulnerability. Within 7 days, implement compensating controls including enhanced access logging for cross-user data access attempts, restrict sensitive API access patterns where technically feasible, and conduct focused code review of user data access pathways; communicate vulnerability details and interim protections to affected stakeholders and end users. Within 30 days, establish formal communication channels with Menulux Software Inc. to obtain confirmed patch release timeline, complete detailed assessment of any confirmed unauthorized access incidents, develop a patching plan contingent on vendor patch availability, and evaluate alternative products if vendor remediation timelines exceed organizational risk tolerance.

Menulux Mobile App CVE-2026-2346

EUVD-2026-52263 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-03 TR-CERT

GHSA-vhg6-8gp7-pg76

Authentication Bypass Mobile App Menulux Software Inc

9.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

CWE-639 key manipulation realistically needs an authenticated session (PR:L) and yields integrity tampering (I:H) with only incidental data exposure (C:L) and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 13:20 vuln.today

CVE Published

Aug 03, 2026 - 11:49 cve.org

CRITICAL 9.8

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack.

This issue affects Mobile App: through 12.05.2026.

AnalysisAI

Authorization bypass in Menulux Software Inc. Mobile App (all versions through the 12.05.2026 build) lets remote attackers manipulate a user-controlled key (an Insecure Direct Object Reference, CWE-639) to reach or alter resources belonging to other users, enabling a software integrity attack. TR-CERT rates it CVSS 9.8 with full CIA impact, though the primary documented effect is integrity tampering. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Menulux is a Turkish restaurant/hospitality platform (digital menu, ordering and POS integration) and this flaw resides in its companion Mobile App, identified by CPE cpe:2.3:a:menulux_software_inc.:mobile_app. The root cause is CWE-639, Authorization Bypass Through User-Controlled Key: the application uses a client-supplied identifier (such as a user, order, or object ID passed in an API request) to select a backend record without verifying that the requesting principal is authorized to act on that record. Because the object reference is direct and trusted, changing the key value in a request causes the server to operate on another tenant's or user's object, which the advisory characterizes as a software integrity attack.

RemediationAI

Upgrade the Menulux Mobile App to a build newer than the 12.05.2026 version once the vendor publishes a fixed release; the input data provides no exact fixed version number, so this is a patch-available-per-advisory situation rather than a confirmed tagged release - track the TR-CERT bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0729 and contact Menulux to confirm the corrected build. Until a fix is deployed, apply server-side authorization enforcement so that every request validating a user-supplied object key checks ownership/tenancy (do not rely on the client-provided ID alone); where feasible, replace direct sequential object references with unguessable/opaque tokens or per-session mappings, and add server-side access-control logging and rate limiting on the affected API endpoints to detect key-enumeration attempts. These controls are backend changes and may require vendor cooperation since the flaw is in a packaged mobile product; the trade-off is added request-validation overhead and potential integration testing against existing clients.