EUVD-2026-42209
GHSA-jp2f-v3mv-mpr8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable ACL bypass requires only a low-privilege account; no integrity or availability impact described.
Primary rating from Vendor (usom).
CVSS VectorVendor: usom
Lifecycle Timeline
1DescriptionCVE.org
Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Nomysem: through 08072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Nomysem, an education and consulting management platform by Turkish vendor NOMYSOFT Informatics, exposes sensitive information to authenticated low-privilege users due to incompatible ACL policies that fail to properly constrain access to restricted functionality. Network-accessible endpoints can be reached by any valid account holder, yielding high-confidentiality-impact data exposure without requiring elevated rights or user interaction. No public exploit code has been identified at time of analysis; however, the vendor failed to respond to coordinated disclosure, leaving the vulnerability unpatched.
Technical ContextAI
CWE-213 (Exposure of Sensitive Information Due to Incompatible Policies) describes a class of flaws where multiple access control policies within an application are inconsistent with one another - the enforced permissions diverge from the intended security policy, causing data or functionality to be accessible to principals who should be excluded. In this case, the Nomysem platform's ACL enforcement is insufficient to prevent authenticated low-privilege users from accessing protected functionality or data via network-reachable endpoints. No CPE strings were provided in the input data, so exact software components and version identifiers cannot be confirmed from authoritative sources. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is consistent with an application-layer access control defect reachable over HTTP/HTTPS by any valid session.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor (NOMYSOFT Informatics Education and Consulting Inc.) was contacted prior to disclosure and did not respond, leaving no official fix confirmed. Organizations running Nomysem should consult the Turkish USOM advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0516 for any updated guidance. As immediate compensating controls: restrict Nomysem network exposure to trusted internal segments only, removing public internet accessibility where not strictly required (trade-off: may impact remote access workflows); enforce the principle of least privilege by auditing all user accounts and eliminating unnecessary low-privilege accounts; enable detailed access logging on the application and review logs for anomalous data access patterns; and consider deploying a web application firewall to monitor and alert on abnormal request patterns targeting restricted endpoints. These controls reduce exposure but do not remediate the underlying ACL policy defect.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today