What is the CVSS score of EUVD-2026-42015?

EUVD-2026-42015 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Ontime are affected by EUVD-2026-42015?

Idvlabs Ontime versions through build 04052026 contains an unauthenticated insecure direct object reference vulnerability allowing remote attackers to read confidential data across users and tenants.

How to fix or mitigate EUVD-2026-42015?

Within 24 hours: Inventory all Ontime instances and review access logs for unauthorized cross-tenant or cross-user data requests. Within 7 days: Implement network access controls limiting API connectivity to authorized clients only, enable detailed logging on Ontime data endpoints, and notify potentially affected users and tenants. Within 30 days: Monitor vendor security advisories (TR-26-0503) and vendor communications for patch availability; establish weekly log review procedures to detect exploitation.

Ontime EUVD-2026-42015

| CVE-2026-5799 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 TR-CERT

GHSA-vh24-w6w7-q6mw

Authentication Bypass Ontime

7.5

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable low-complexity IDOR exposing others' data (C:H, I/A:N); assessed PR:L because CWE-639 typically requires a valid session whose identifier is manipulated, though the source vector claims PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 08:02 vuln.today

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers.

This issue affects Ontime: through 04052026.

AnalysisAI

Insecure Direct Object Reference in Idvlabs Ontime (all versions through build 04052026) lets remote attackers read data belonging to other users or tenants by substituting trusted identifiers in requests, without authentication per the published CVSS vector (PR:N). The flaw exposes confidential data only (C:H/I:N/A:N) and was reported by Turkey's TR-CERT under advisory TR-26-0503. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was provided.

Technical ContextAI

Ontime is a workforce/time-management application developed by Idvlabs Software and Consulting Services Inc. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference (IDOR) - the application trusts a client-supplied identifier (such as a record, user, or object ID) as an implicit authorization token and fails to verify that the requesting principal is actually entitled to the referenced object. The advisory's 'Exploitation of Trusted Identifiers' pattern (CAPEC-21) means an attacker manipulates or reuses these predictable/enumerable identifiers to access another principal's resources. The single affected CPE is cpe:2.3:a:idvlabs_software_and_consulting_services_inc.:ontime:*:*:*:*:*:*:*:*, indicating all versions are in scope with no version-specific carve-out beyond the build cutoff.

RemediationAI

Upgrade Ontime to a fixed build released after 04052026 as directed by the vendor and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0503); an exact patched version string was not provided in the source data, so confirm the fixed build number directly with Idvlabs - patch available per vendor advisory, released patched version not independently confirmed. Until patched, apply compensating controls: enforce server-side authorization checks that bind every object identifier to the requesting session, replace sequential/predictable IDs with unguessable UUIDs to defeat enumeration, and place the application behind authenticated access controls or a WAF/reverse-proxy rule that rate-limits and logs bulk identifier iteration (trade-off: WAF pattern rules cannot reliably distinguish a legitimate ID from a malicious one, so this only slows enumeration and adds detection, it does not close the flaw). Restrict network exposure of the Ontime interface to trusted networks/VPN where operationally feasible to reduce the unauthenticated attack surface until the upgrade is deployed.