Liman MYS EUVD-2026-52685

Exploitation requires a valid low-privilege user account on the Liman MYS instance (confirmed by CVSS PR:L). The attacker must have network access to the Liman MYS web interface. No special configuration, non-default settings, or additional software state is required beyond having any authenticated session - the missing authorization check is present in the default application logic across affected versions. Exploitation is limited by the need for at least one valid credential; unauthenticated external attackers cannot exploit this directly. Specific ACL-restricted functionality that can be accessed is not detailed in available data, but the full C:H/I:H/A:H impact vector indicates privileged system management operations are reachable.

The CVSS 8.8 High score reflects the genuine severity of this flaw: network-accessible (AV:N), low complexity (AC:L), requiring only a low-privilege account (PR:L), with no user interaction needed (UI:N), and full CIA impact. The primary mitigating factor is the PR:L requirement - an attacker must first obtain a valid user account in Liman MYS, which reduces opportunistic exploitation. No EPSS score was provided, and neither KEV status nor public POC availability has been confirmed, suggesting this is not currently being exploited at scale. However, the combination of low attack complexity and high impact makes this a credible internal threat or post-compromise escalation path. SSVC signals suggest this warrants prompt patching for any internet-exposed Liman MYS deployments. The advisory originates from TR-CERT (Turkish national CERT), indicating coordinated disclosure.

An attacker with a low-privilege Liman MYS account - such as a standard operator or read-only user - sends crafted HTTP requests directly to privileged API endpoints or management functions that should be restricted to administrators. Because authorization checks are missing, the server processes these requests without verifying the caller's role, granting the attacker full control over managed server infrastructure. No public proof-of-concept code has been identified at time of analysis, but the low complexity and straightforward HTTP-based attack vector make independent reproduction highly feasible.