What is the CVSS score of CVE-2026-5730?

CVE-2026-5730 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Ontime are affected by CVE-2026-5730?

Idvlabs Ontime (all versions through build 04052026) is vulnerable to unauthenticated data exposure, allowing unauthorized access to confidential records belonging to other users without…

How to fix or mitigate CVE-2026-5730?

Within 24 hours: Conduct inventory of Ontime deployments and assess stored data sensitivity. Within 7 days: Implement network-level access restrictions (firewall/VPN) to limit Ontime connectivity to authenticated internal users, enable comprehensive audit logging for record access, and request patch timeline from Idvlabs. Within 30 days: Deploy application-level input validation hardening per vendor guidance if available, or initiate product replacement evaluation if no patch timeline is established.

Ontime CVE-2026-5730

EUVD-2026-42014 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 TR-CERT

GHSA-c7r3-xx63-qf62

Authentication Bypass Ontime

7.5

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network IDOR with low complexity and confidentiality-only impact; PR:L chosen because 'Trusted Identifiers' access typically requires an authenticated low-privilege session despite the input's PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 08:00 vuln.today

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers.

This issue affects Ontime: through 04052026.

AnalysisAI

Insecure Direct Object Reference in Idvlabs Ontime (all versions through build 04052026) lets remote unauthenticated attackers read confidential records belonging to other users by tampering with user-controlled resource identifiers. Because the application trusts client-supplied keys without verifying ownership, an attacker can enumerate or substitute IDs to exfiltrate data they should not access. There is no public exploit identified at time of analysis, but the flaw is trivial to exercise (AV:N/AC:L/PR:N) and was flagged by Turkey's national CERT (TR-CERT).

Technical ContextAI

Ontime is a workforce/time-and-attendance and HR management application from the Turkish vendor Idvlabs Software and Consulting Services Inc. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), the class commonly known as IDOR/BOLA: an object identifier - such as a record ID, user ID, or document reference passed in a request parameter - is used to fetch data without a server-side check that the requesting principal actually owns or is authorized for that object. The MITRE sub-pattern 'Exploitation of Trusted Identifiers' indicates the server trusts an identifier presented by the client as proof of authorization. The affected component is identified by CPE cpe:2.3:a:idvlabs_software_and_consulting_services_inc.:ontime:*:*:*:*:*:*:*:*, covering all product versions.

RemediationAI

No vendor-released patch version was identified at time of analysis; consult the vendor and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0503) for a fixed build superseding 04052026 and apply it once available. As compensating controls until a patch is deployed: enforce server-side object-level authorization so every request validates that the authenticated user owns the referenced identifier (the definitive fix); restrict access to the affected Ontime endpoints via network segmentation, VPN, or IP allow-listing to limit who can reach them (trade-off: may block legitimate remote/mobile users); and monitor application logs for sequential or anomalous identifier enumeration and rate-limit such requests (trade-off: enumeration over valid-looking IDs may still evade thresholds). Replacing sequential/guessable identifiers with unguessable random tokens raises the bar but is not a substitute for authorization checks.