What is the CVSS score of EUVD-2026-34840?

EUVD-2026-34840 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Which versions of Geographic Tracking System are affected by EUVD-2026-34840?

HAVELSAN Inc. Geographic Tracking System versions prior to v0.0.2 contain a critical authorization bypass vulnerability (CVSS 9.1) that enables unauthenticated remote attackers to access and modify…

How to fix or mitigate EUVD-2026-34840?

Within 24 hours: Identify all instances of HAVELSAN GTS in production and assess user exposure scope. Within 7 days: Implement network segmentation to restrict access to the affected systems, enable detailed logging of data access, and contact HAVELSAN for patch availability and timeline. Within 30 days: Apply vendor patch to v0.0.2 or later, conduct access log review for evidence of unauthorized access or modification.

Geographic Tracking System EUVD-2026-34840

| CVE-2026-6208 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-05 TR-CERT

GHSA-978c-95pr-x896

Authentication Bypass Geographic Tracking System Havelsan Inc

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:00 vuln.today

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in HAVELSAN Inc. Geographic Tracking System allows Exploitation of Trusted Identifiers.

This issue affects Geographic Tracking System: before v0.0.2.

AnalysisAI

Authorization bypass in HAVELSAN Inc. Geographic Tracking System versions prior to v0.0.2 allows remote unauthenticated attackers to access or modify other users' data by manipulating user-controlled identifiers. The CVSS 9.1 score reflects high confidentiality and integrity impact achievable over the network without authentication, though no public exploit identified at time of analysis. The flaw was reported by TR-CERT (Turkey's national CERT), suggesting coordinated disclosure for a regionally deployed product.

Technical ContextAI

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). In this class of flaw, the application uses an identifier supplied by the client - such as a record ID, user ID, or asset tag in a URL parameter, request body, or header - to look up data without verifying that the requesting principal is authorized to access that specific object. HAVELSAN is a Turkish defense and IT contractor, and the affected Geographic Tracking System (CPE: cpe:2.3:a:havelsan_inc.:geographic_tracking_system) is a location/asset tracking platform where such an IDOR would likely permit one tenant or user to enumerate or modify geolocation records belonging to others.

RemediationAI

Upgrade Geographic Tracking System to v0.0.2 or later, which is the patched version per the advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0325 (vendor-released patch: v0.0.2). If immediate upgrade is not feasible, restrict network exposure of the application to trusted management networks or VPN-only access to reduce the unauthenticated attack surface, and place a reverse proxy or WAF in front of the application to log and rate-limit requests to object-lookup endpoints so anomalous ID enumeration can be detected - note this is detective rather than preventive and does not fix the underlying authorization check. Auditing application logs for sequential or out-of-pattern access to tracking-record identifiers is recommended to identify any prior abuse, since the flaw leaves no other characteristic artifact.