What is the CVSS score of EUVD-2026-45166?

EUVD-2026-45166 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Proliz OBS are affected by EUVD-2026-45166?

Proliz Software's OBS student information system exposes confidential student records to remote attackers without requiring login credentials, affecting educational institutions using versions before…

How to fix or mitigate EUVD-2026-45166?

Within 24 hours, immediately verify which OBS versions are deployed in your environment and alert stakeholders; implement network-layer access controls to restrict OBS connectivity to authorized administrative networks only, and enable detailed audit logging on all student records access. Within 7 days, engage Proliz Software to confirm your upgrade timeline and obtain v3.6.0 availability, deploy enhanced monitoring to detect unusual access patterns or bulk data extraction attempts against student records, and analyze access logs from the past 30 days for evidence of unauthorized activity. Within 30 days, execute the upgrade to OBS v3.6.0 or later, validate that access controls function correctly post-upgrade in your production environment, and conduct a data protection assessment to determine if any student personally identifiable information was accessed during the vulnerability window.

Proliz OBS EUVD-2026-45166

| CVE-2026-7189 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-07-17 TR-CERT

GHSA-xmc7-8g95-v5fj

Information Disclosure Proliz S Obs

7.5

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated endpoint with a missing ACL check (AV:N/AC:L/PR:N/UI:N) discloses sensitive data, giving high confidentiality impact and no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 17, 2026 - 14:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 17, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jul 17, 2026 - 14:22 NVD

8.2 (HIGH) 7.5 (HIGH)

Analysis Generated

Jul 17, 2026 - 13:30 vuln.today

CVE Published

Jul 17, 2026 - 12:44 nvd

HIGH 8.2

DescriptionCVE.org

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Proliz's OBS: before v3.6.0.

AnalysisAI

Sensitive information disclosure in Proliz Software's OBS (a student information management system) affects all versions before v3.6.0, allowing remote unauthenticated attackers to reach functionality that is not properly restricted by access-control lists (CWE-201) and retrieve confidential data. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N, C:H only) confirms network-reachable, no-privilege access with high confidentiality impact but no integrity or availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

OBS (Öğrenci Bilgi Sistemi) is a web-based student/academic information system produced by the Turkish vendor Proliz Software Ltd. Co., identified by CPE cpe:2.3:a:proliz_software_ltd._co.:proliz's_obs:*. The root cause is CWE-201, Insertion of Sensitive Information Into Sent Data, combined with a broken-access-control condition ("Accessing Functionality Not Properly Constrained by ACLs"): server responses or exposed endpoints return sensitive data to callers who should not be authorized to receive it, because authorization is not enforced on the functionality that emits the data. In practice this class of flaw means the application trusts the client or a predictable/enumerable request path rather than validating the requester's entitlement before including protected records in the response body.

RemediationAI

Upgrade to OBS v3.6.0 or later, which is the vendor-designated fixed release (all versions before v3.6.0 are affected); this qualifies as a vendor-released patch: v3.6.0. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0571 and the VulDB record at https://vuldb.com/vuln/379784 for coordination details. Until the upgrade is applied, restrict network reachability of the OBS application - place it behind a VPN or IP allowlist so only campus/institutional networks can reach it, and use a WAF or reverse-proxy rule to block or authenticate the specific unauthorized endpoints that return sensitive data; the trade-off is that VPN/allowlisting can break legitimate off-campus student and staff access, so scope the restriction to the vulnerable functions where possible. Monitor application access logs for anomalous or high-volume requests to data-returning endpoints as a detective control.