What is the CVSS score of CVE-2026-25365?

CVE-2026-25365 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Kargo Takip are affected by CVE-2026-25365?

CVE-2026-25365 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.. A patch is available.

Kargo Takip CVE-2026-25365

Q: How to fix or mitigate CVE-2026-25365?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

EUVD-2026-15687 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-c33c-vr44-685c

Authentication Bypass Kargo Takip

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

0.2.4

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15687

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4.

AnalysisAI

Kargo Takip versions prior to 0.2.4 contain a missing authorization vulnerability that allows authenticated users to modify data or perform unauthorized actions due to improper access control enforcement. An attacker with valid credentials could exploit this weakness to manipulate shipment tracking information or other protected resources without proper privilege verification. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	While a CVSS score and vector are not provided, the CWE-862 classification combined with the 'Authentication Bypass' tag indicates this is a high-severity issue with direct exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker navigates directly to a protected cargo tracking endpoint or admin function within the Kargo Takip plugin. Due to missing authorization checks, the plugin fails to validate the attacker's permissions and returns sensitive cargo tracking data or allows modification of tracking records. …
Remediation	Immediately upgrade the Kargo Takip plugin to version 0.2.4 or later from the official WordPress plugin repository or the vendor's distribution channel. … Detailed patch versions, workarounds, and compensating controls in full report.