What is the CVSS score of EUVD-2026-45965?

EUVD-2026-45965 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Corporate Training Management System EUVD-2026-45965

| CVE-2026-13724 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-20 TR-CERT

GHSA-vv59-x63g-cp8m

Information Disclosure Corporate Training Management System

4.3

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible web app; authenticated user (PR:L) required; no confidentiality or availability impact, only low integrity via data manipulation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:12 vuln.today

DescriptionCVE.org

Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation.

This issue affects Corporate Training Management System: before dd1a9df64.

AnalysisAI

Client-side security enforcement bypass in Gobito's Corporate Training Management System permits authenticated users to manipulate input data that the server accepts without independent validation. The root cause is CWE-602: security controls enforced only in the browser are trivially circumvented by crafting direct HTTP requests, bypassing form-level restrictions. No active exploitation has been identified, and CVSS places this at Medium (4.3), reflecting limited integrity impact constrained by the authentication prerequisite.

Technical ContextAI

CWE-602 (Client-Side Enforcement of Server-Side Security) describes a design flaw where an application trusts input validation performed in the browser rather than re-validating on the server. Attackers bypass these controls by intercepting and modifying requests (e.g., via a proxy such as Burp Suite) or submitting crafted requests directly to server endpoints. The affected product is identified by CPE cpe:2.3:a:gobito_informatics_technologies_engineering_industry_and_trade_ltd._co.:corporate_training_management_system:*:*:*:*:*:*:*:* and appears to be a web-based training administration platform. All versions prior to commit dd1a9df64 are confirmed affected per the EUVD entry EUVD-2026-45965. The 'Information Disclosure' tag associated with this CVE introduces a discrepancy with the CVSS C:N metric; the primary confirmed impact from the description and CVSS vector is integrity (data manipulation), not confidentiality.

RemediationAI

Upgrade the Corporate Training Management System to a build at or beyond commit dd1a9df64, which represents the upstream fix per TR-CERT advisory https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0582. Note that a tagged release version was not independently confirmed - only the commit reference is cited, so organizations should verify with Gobito that the deployed build includes this commit. As a compensating control prior to patching, implement server-side input validation at all API and form submission endpoints to reject or sanitize values that fall outside permitted ranges or roles; this directly addresses the CWE-602 root cause. Additionally, restrict application access to the minimum required user population and enable audit logging on data-write endpoints to detect anomalous submissions from authenticated users.