What is the CVSS score of CVE-2026-5230?

CVE-2026-5230 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Pizzy Library are affected by CVE-2026-5230?

MIA Technology Inc. Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 contain an access control vulnerability allowing authenticated users to bypass authorization and access resources outside…. A patch is available.

How to fix or mitigate CVE-2026-5230?

24 hours: Create inventory of all systems and applications using Pizzy Library versions 1.0.0.26250-1.3.9.26250 across production and development environments. 7 days: Analyze access logs for suspicious cross-role or cross-user resource access patterns; implement compensating controls listed below. 30 days: Contact MIA Technology Inc. for patch timeline and approved fix versions; plan upgrade path or evaluate library alternatives if patching is not feasible within acceptable timeline.

Pizzy Library CVE-2026-5230

EUVD-2026-36717 HIGH

Improper Access Control (CWE-284)

2026-06-15 TR-CERT

GHSA-q45q-8hg9-fpfw

Authentication Bypass Pizzy Library Mia Technology Inc

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (TR-CERT) PRIMARY

HIGH

qualitative

NVD

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-reachable authorization bypass requires an existing low-privilege account (PR:L), no user interaction or special complexity, yielding high confidentiality, low integrity, and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 15, 2026 - 16:01 EUVD

Analysis Generated

Jun 15, 2026 - 14:30 vuln.today

DescriptionNVD

Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

AnalysisAI

Improper access control in MIA Technology Inc. Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticated remote attackers to bypass authorization checks and access resources or actions outside their permission level. The flaw was reported by TR-CERT and carries a CVSS 3.1 base score of 7.1, with high confidentiality impact but only low integrity impact and no availability impact; no public exploit identified at time of analysis.

Technical ContextAI

Pizzy Library is a software component distributed by MIA Technology Inc. (cpe:2.3:a:mia_technology_inc.:pizzy_library). The weakness is classified as CWE-284 (Improper Access Control), with vendor tagging it as an authentication bypass involving 'incorrectly configured access control security levels.' This pattern typically arises when authorization checks rely on misconfigured role/permission tiers, allowing an authenticated principal at one security level to invoke functionality or read data intended for a higher tier. The CWE-284 root cause indicates the library either fails to enforce a check on a protected operation or evaluates the security level against an attacker-controllable or inconsistently-applied policy.

RemediationAI

Upstream fix available; the version range 'before 1.3.9.26250' indicates that 1.3.9.26250 is the first non-vulnerable release, so administrators should upgrade Pizzy Library to 1.3.9.26250 or later as obtained from MIA Technology Inc. Confirm the build against the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0383. Until the upgrade is deployed, compensating controls should focus on the authorization layer: restrict network reachability of the library's endpoints to trusted internal segments via firewall or reverse-proxy ACLs (trade-off: breaks legitimate remote integrations); minimize the population of low-privilege accounts that can reach the affected functionality and audit role assignments for over-broad security levels (trade-off: operational overhead and possible workflow disruption); and enable detailed access logging on the affected endpoints to detect anomalous cross-tier access (trade-off: increased log volume and storage cost).