What is the CVSS score of CVE-2026-6209?

CVE-2026-6209 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Which versions of Geographic Tracking System are affected by CVE-2026-6209?

A critical authorization bypass in HAVELSAN Geographic Tracking System (versions before 0.0.2) exposes sensitive location and movement data to unauthorized remote access without authentication.

How to fix or mitigate CVE-2026-6209?

24 hours: Conduct full inventory of HAVELSAN Geographic Tracking System deployments; isolate any pre-0.0.2 instances from external and untrusted networks. 7 days: Deploy Web Application Firewall (WAF) or API gateway to enforce authentication requirements; enable comprehensive audit logging of all system access attempts; review recent access logs for signs of unauthorized data retrieval. 30 days: Apply HAVELSAN patch to v0.0.2 or later when released; validate patch functionality through security testing before returning systems to normal operation.

Geographic Tracking System CVE-2026-6209

EUVD-2026-34841 CRITICAL

Improper Access Control (CWE-284)

2026-06-05 TR-CERT

GHSA-q66c-6wwq-qf8f

Authentication Bypass Geographic Tracking System Havelsan Inc

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:01 vuln.today

DescriptionCVE.org

Improper Access Control, Missing Authorization vulnerability in HAVELSAN Inc. Geographic Tracking System allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Geographic Tracking System: before v0.0.2.

AnalysisAI

Authorization bypass in HAVELSAN Geographic Tracking System versions prior to v0.0.2 allows remote unauthenticated attackers to access restricted functionality and sensitive geospatial tracking data due to missing ACL enforcement. The CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) vector and CWE-284 classification indicate trivially exploitable broken access control affecting confidentiality and integrity of tracked entities. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

HAVELSAN Geographic Tracking System is a Turkish defense/technology vendor product used to monitor and manage the location of personnel, vehicles, or assets in real time. The flaw is rooted in CWE-284 (Improper Access Control) combined with missing authorization checks - the application exposes server-side functions or API endpoints that should enforce role/identity-based ACLs but instead permit calls from any caller. Per the CPE (cpe:2.3:a:havelsan_inc.:geographic_tracking_system) all versions of the product up to but not including v0.0.2 are affected, suggesting the issue existed during early production releases before authorization middleware was hardened.

RemediationAI

Upgrade HAVELSAN Geographic Tracking System to v0.0.2 or later, which per the affected-version range contains the access-control fix; consult the TR-CERT bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0325 for vendor coordination details. Until the upgrade is applied, restrict network reachability of the application to authenticated VPN/management segments and place an authenticating reverse proxy or WAF in front of the API endpoints to enforce identity checks (trade-off: legitimate mobile or field clients may need new credentials/cert provisioning). Audit application and web-server logs for anomalous reads of tracking endpoints or unexpected entity enumeration since deployment, and rotate any operational identifiers that may have been exposed.