What is the CVSS score of CVE-2026-2406?

CVE-2026-2406 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Registration Workflow System CVE-2026-2406

EUVD-2026-47621 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-22 iletisim@usom.gov.tr

GHSA-fcfg-fr25-xwpr

Authentication Bypass

6.5

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L confirmed because a valid user session is required; C:H reflects unrestricted read access to other users' records; I:N and A:N because no write or disruption impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:31 vuln.today

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client.

This issue affects Online Registration and Workflow Management System: through 12022026.

AnalysisAI

Authorization bypass in Universe Software's Online Registration and Workflow Management System (through version 12022026) allows authenticated low-privilege users to access other users' registration records by manipulating user-controlled key parameters. The vulnerability, classified as CWE-639 (IDOR), exposes a high-severity confidentiality impact with no integrity or availability risk - attackers can read but not modify data. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any authenticated user of the platform.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) is a class of Insecure Direct Object Reference (IDOR) vulnerability in which the application uses a caller-supplied value - such as a numeric record ID, UUID, or username embedded in a URL or POST parameter - to look up a resource without verifying that the requesting user is authorized to access that specific record. The affected product is Universe Software Computer Marketing Trade and Industry Inc.'s Online Registration and Workflow Management System, a Turkish commercial platform for managing administrative registration and workflow processes. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms the flaw is reachable over the network, requires no special conditions, demands only a low-privilege authenticated session, and yields full confidentiality exposure of the targeted resource with no impact on integrity or availability.

RemediationAI

Upstream fix details are not specified in the available data - the affected versions extend 'through 12022026' with no confirmed patched release version provided. Organizations should consult the Turkish USOM advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0594 and contact Universe Software Computer Marketing Trade and Industry Inc. directly for an updated build. As a compensating control pending patch availability, access to the affected registration endpoints should be restricted to the minimum required user roles, and server-side authorization checks should be enforced on all resource retrieval operations so that user-supplied identifiers are validated against the authenticated session's ownership or permissions. Audit logging of record-access events should be enabled to detect unauthorized cross-user data access. No patch version has been independently confirmed from available input data.