EUVD-2026-29442
GHSA-q4cr-cjq5-h3m4
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers.
This issue affects BAPSİS: before v.202604152042.
AnalysisAI
Authorization bypass in BAPSİS web application enables unauthenticated remote attackers to exploit trusted identifiers through user-controlled keys when victims interact with crafted requests. ABIS Technology's BAPSİS platform (versions before v.202604152042) contains a CWE-639 flaw where authorization checks rely on client-controlled key values, allowing attackers to manipulate trust relationships and gain unauthorized access with high impact to confidentiality, integrity, and availability. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all BAPSİS installations and document current versions; contact ABIS Technology support for patch availability timeline. Within 7 days: If patch released, test in non-production environment and plan deployment; if no patch, implement network segmentation to restrict BAPSİS access to trusted networks only and enforce additional authentication controls at the application gateway level. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today