FlexCity EUVD-2026-46188

Exploitation requires a valid low-privilege authenticated session within FlexCity (CVSS PR:L). The attacker must be able to reach the FlexCity application over the network (CVSS AV:N), but no elevated privileges, administrator access, or special configuration state is required beyond basic account access. No user interaction is needed from a victim (UI:N). The primary limiting factor is possession of any valid FlexCity account - unauthenticated external attackers cannot directly exploit this vulnerability. Environments that restrict account creation, enforce strong credential policies, or limit FlexCity network exposure to trusted internal segments significantly reduce the realistic attack surface.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a medium-severity, network-exploitable confidentiality breach requiring only a valid low-privilege account - no special configuration, no user interaction, and no elevated rights beyond basic authenticated access. This is a meaningful real-world risk in multi-tenant or role-separated deployments of FlexCity where sensitive data is expected to be partitioned by access control level. The scope is unchanged (S:U), meaning exploitation does not pivot to other systems, but C:H indicates the attacker can fully read data they should not access within the affected system. No EPSS score was provided in the input data, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation at time of analysis. The TR-CERT origin of the report indicates this may have regional or industry-specific deployment relevance. The primary risk amplifier is the low privilege bar (PR:L): any valid account in the system can attempt exploitation, making insider threat and credential-compromise scenarios the realistic attack surface.

An attacker who holds any valid low-privilege account in FlexCity - such as a read-only user or restricted operator - sends a crafted network request directly to an endpoint or resource governed by a higher access control security level. Because the server omits or incorrectly evaluates the authorization check, the request succeeds and returns sensitive data the account should not be permitted to read. No public proof-of-concept code has been identified, but the low complexity and low privilege requirement mean that any authenticated insider or compromised low-privilege credential could be used to attempt this without specialized tooling.