EUVD-2026-88744
GHSA-7vxw-4w97-qq87
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySend request to unprotected privileged function
-
ExploitServer skips authorization check
-
ExecutionPerform privileged action / access restricted data
-
ImpactFull compromise of confidentiality, integrity, availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account on Qorela DC (CVSS PR:L) with network reachability to the application (AV:N); no user interaction is needed (UI:N) and complexity is low (AC:L). Exploitation targets application functions where authorization is not enforced, allowing the low-privilege user to perform higher-privileged actions. The primary limiting factor is the need for valid credentials/an existing account on the affected system - this is not unauthenticated exploitation. Affected versions are 1.6.1-RC29 up to (but not including) v1.6.2; upgrading to v1.6.2 removes the exposure. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity missing-authorization flaw exploitable by an already-authenticated low-privilege user with no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with the CWE-862/'Privilege Abuse' description. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so despite the high base score there is no evidence of active or imminent exploitation. This tempers real-world urgency: the score reflects potential impact for an attacker who already holds a valid low-privilege account, not mass unauthenticated exploitability. The single reference is a TR-CERT (Turkish national CERT) advisory, indicating vendor/CERT-coordinated disclosure rather than observed in-the-wild attacks. Net: a genuinely serious authorization defect for anyone running Qorela DC, but priority is bounded by narrow product deployment and the requirement for pre-existing authenticated access. |
| Exploit ScenarioDerived | An attacker with a legitimate but low-privilege Qorela DC account sends crafted requests to functionality that fails to enforce authorization checks, letting them access or perform actions reserved for higher-privileged users (privilege abuse). Because the CVSS vector is AV:N/PR:L/UI:N, this requires only network access and a valid low-level account with no victim interaction. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Privilege abuse in Interprobe Information Technologies Inc. Qorela DC from 1.6.1-RC29 before v1.6.2 allows an authenticated low-privilege user to perform higher-privileged actions because authorization checks are missing on affected application functions. The flaw is network-reachable, low-complexity, and requires no user interaction, resulting in high confidentiality, integrity, and availability impact with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis, and upgrading to v1.6.2 removes the exposure.
RemediationAI
Vendor-released patch: upgrade Qorela DC to v1.6.2 or later, which removes the exposure according to the available version guidance. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1209 for any additional vendor-specific instructions. Until upgrading is possible, restrict network access to Qorela DC instances to trusted management networks and limit low-privilege account provisioning, understanding that these controls may reduce legitimate access for remote users. Audit application logs for unauthorized or unexpected actions performed by low-privilege accounts as a detective control, though logging alone does not prevent exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-862 Missing Authorization, meaning the Qorela DC application fails to enforce access control checks on certain functions after a user is authenticated. The CPE cpe:2.3:a:interprobe_information_technologies_inc.:qorela_dc:*:*:*:*:*:*:*:* identifies Interprobe Information Technologies Inc. Qorela DC as the affected product. Because the CVSS vector includes PR:L, exploitation requires a valid low-privilege account; it is not unauthenticated. The network vector and low attack complexity mean an attacker with such an account can directly invoke improperly protected operations, leading to privilege abuse without user interaction. Versions from 1.6.1-RC29 up to but not including v1.6.2 are affected.
Know when Qorela Dc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated low-privilege user (PR:L) exploits missing authorization remotely (AV:N) with low complexity and no interaction, gaining full C/I/A over the same system (S:U).
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
DescriptionCVE.org
Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse.
This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.
Executive ViewAI
Interprobe Qorela DC versions 1.6.1-RC29 through pre-1.6.2 contain an authorization bypass vulnerability that lets any authenticated low-privilege user perform higher-privileged actions, potentially exposing sensitive data, altering configurations, or disrupting operations. No public exploit was identified at time of analysis, but the flaw is network-reachable, low-complexity, and requires no user interaction, meaning a compromised or malicious low-privilege account could cause significant harm. Leadership should prioritize immediate remediation because the affected systems support critical business functions and a successful attack could lead to data breaches or operational downtime.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB