MobilMen 20T CVE-2026-2398

Exploitation requires an authenticated session on MobilMen 20T (CVSS PR:L - a valid low-privileged account is a prerequisite, obtainable via insider access, credential theft, or self-registration if enabled), reachable over the network (AV:N) with low attack complexity and no user interaction (AC:L/UI:N). The concrete trigger is the application's use of a user-controlled key (CWE-639) - an attacker must be able to submit a request containing a direct object/user identifier that the server resolves without an ownership check. Limiting factors: the attacker cannot exploit fully unauthenticated, must run a version from v3 through build 10072026, and success depends on knowing or enumerating valid identifiers for higher-privileged accounts or other tenants.

Signals are moderately consistent but incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability - a realistic priority for any environment running this product. However, there is no EPSS score, no KEV listing, and no known POC provided, so exploitation is currently theoretical rather than observed; treat the 8.8 as a capability rating, not evidence of active campaigns. The main risk-limiting factor is that an attacker must already hold a valid (if low-privileged) account, which typically means an insider, a compromised credential, or a self-registerable tenant. The most important caveat is data completeness: the vendor did not respond, there is no advisory beyond the TR-CERT bulletin, and no patch is confirmed - so defenders cannot yet rely on an upstream fix.

An attacker who holds or acquires a low-privileged MobilMen 20T account (for example a basic field-sales login) intercepts an application request and swaps the user- or object-identifier parameter for that of an administrator or another tenant. Because the server trusts the client-supplied key, the request executes with the target's privileges, granting the attacker elevated access to read, modify, or disrupt data. No user interaction or exploit toolkit is required, though no public POC is currently known.