Pik Online Portal CVE-2026-6217

Exploitation requires the attacker to hold a low-privileged authenticated account within Pik Online Portal (PR:L per CVSS vector). The UI:R metric indicates that some user interaction - likely a legitimate user authenticating or performing an action that causes hash values to be generated or surfaced - is also required. The attacker must additionally be able to access or exfiltrate the stored hash values (the specific mechanism - API, admin panel, database exposure - is not detailed in available sources). Limiting factors include: the need for authenticated access (eliminates fully unauthenticated remote attackers), the requirement for user interaction, and the offline nature of hash cracking (requires hash exfiltration before any password is recovered). This is not a default-unauthenticated exploit; access to the portal is a prerequisite.

The vendor CVSS score of 6.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) reflects a medium-severity issue requiring authentication and user interaction, which meaningfully constrains real-world exploitability compared to a fully unauthenticated flaw. The C:H rating is warranted: successful hash cracking yields plaintext credentials, potentially enabling full account takeover or privilege escalation if cracked accounts belong to higher-privileged users. I:L likely reflects the secondary ability to modify data once credentials are cracked. No EPSS data, no CISA KEV listing, and no public POC are present, all pointing toward limited opportunistic risk at this time. The primary real-world threat is an insider or low-privileged attacker who extracts hash data and cracks it offline - a realistic scenario in shared-access portal environments. The niche deployment footprint of this Turkish portal product further limits aggregate exposure. One data gap: the exact mechanism by which hashes are exposed to PR:L users is not described in available sources, making the precise exploitation path partially inferred from the CVSS vector rather than confirmed by technical disclosure.

An attacker with a low-privileged account on the Pik Online Portal accesses an endpoint or feature that exposes stored password hashes - such as a user management panel or data export - then runs the extracted unsalted hashes through a precomputed rainbow table or GPU-accelerated hash cracker. Recovered plaintext passwords are then used to authenticate as other users, including potentially administrators, enabling privilege escalation within the portal. No public POC has been identified, but the attack tooling (e.g., Hashcat, CrackStation) for unsalted hash cracking is widely available.