Nomysem CVE-2026-6280

Exploitation requires a valid low-privilege authenticated session on the Nomysem platform, as confirmed by the CVSS PR:L metric - unauthenticated attackers cannot directly exploit this vulnerability. The attack is executable over the network (AV:N) under low complexity conditions (AC:L) with no user interaction required (UI:N), meaning any account holder on the system can attempt exploitation without needing to social-engineer another user. No non-default configuration or specific deployment mode is stated as a prerequisite in the description. The primary limiting factor is the authentication requirement: an attacker must first obtain or already possess a valid Nomysem account, whether through legitimate access, credential theft, or prior compromise.

The NVD CVSS base score of 6.5 (Medium) reflects a meaningful but bounded risk: network reachability (AV:N) and low attack complexity (AC:L) lower the bar for exploitation, while the PR:L requirement anchors risk to authenticated users only, excluding unauthenticated internet attackers. The high confidentiality impact (C:H) suggests that exposed data may be substantive - student records, personnel data, or administrative information typical of education management systems - though the exact data class is unconfirmed from available input. No EPSS score was provided, so probability of exploitation in the wild cannot be quantified. No CISA KEV listing and no public POC have been identified, indicating no confirmed active exploitation at time of analysis. The vendor's non-response to disclosure is a compounding risk signal: there is no patch, no official advisory, and no vendor-confirmed scope, meaning the vulnerability window remains open indefinitely for organizations running Nomysem. Practical risk is constrained by the product's niche, largely Turkish-market deployment footprint.

An attacker with a standard low-privilege account on the Nomysem platform crafts HTTP requests targeting restricted application endpoints that are inadequately protected by the inconsistent ACL policy. The system's access control logic fails to enforce the intended restrictions, returning sensitive data - such as records belonging to other users or administrative information - directly in the response. No public proof-of-concept code has been identified, so exploitation currently requires independent discovery of the vulnerable endpoint.