What is the CVSS score of CVE-2026-6792?

CVE-2026-6792 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

FlexCity CVE-2026-6792

EUVD-2026-46188 MEDIUM

Missing Authorization (CWE-862)

2026-07-21 TR-CERT

GHSA-xm45-c62q-jmp8

Authentication Bypass Flexcity

6.5

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible with low-privilege account required; missing authorization yields full confidentiality loss with no integrity or availability impact, matching S:U scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 13:16 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects FlexCity: from 5.536.0 through 11052026.

AnalysisAI

Missing authorization in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) exposes sensitive data to low-privileged authenticated users who can bypass access control security levels. The vulnerability (CWE-862) allows network-accessible exploitation with low attack complexity, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege network vector makes this a realistic internal threat in any environment running affected versions.

Technical ContextAI

CWE-862 (Missing Authorization) occurs when software performs an operation or grants access to a resource without verifying that the requesting user has been authorized to do so - distinct from authentication failures, this is a failure to enforce access control decisions after identity has been established. FlexCity, developed by Universal Software Inc. (CPE: cpe:2.3:a:universal_software_inc.:flexcity:*:*:*:*:*:*:*:*), appears to expose one or more internal endpoints or functional access control tiers without adequate server-side authorization checks, allowing users operating at a lower privilege tier to invoke functionality or retrieve data reserved for higher security levels. The 'Authentication Bypass' tag suggests the missing check allows a low-privilege session to traverse an incorrectly configured access control boundary. The unusually formatted upper-bound version string '11052026' in the affected range may represent a date-based release identifier (likely 11 May 2026 or November 5 2026), indicating this is a recent disclosure against a currently active release line.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations should consult the TR-CERT security bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0593 and contact Universal Software Inc. directly to obtain patch or upgrade guidance. As compensating controls, administrators should immediately audit role and permission assignments within FlexCity to identify and restrict which accounts hold access to sensitive access-control tiers, and enforce the principle of least privilege by removing unnecessary low-privilege accounts that could serve as an exploitation foothold. Network-level access to the FlexCity application should be restricted to trusted internal segments and known IP ranges to reduce the attack surface, accepting the trade-off of reduced accessibility for remote or distributed users. Monitoring for anomalous access patterns - particularly low-privilege accounts querying endpoints or data normally associated with higher access levels - can provide detection coverage until a vendor patch is available.