EUVD-2026-52691
GHSA-c8qw-pv9p-qhf7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Liman MYS account
-
DeliverySend crafted HTTP request to privileged administrative endpoint
-
ExploitServer skips authorization check (CWE-862)
-
ExecutionAttacker executes administrator-level operations
-
ImpactFull platform compromise with C/I/A impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session with at minimum a low-privilege account on the Liman MYS platform (CVSS PR:L confirmed). The vulnerability is network-accessible (AV:N) with no user interaction beyond the attacker's own crafted request (UI:N), and attack complexity is low (AC:L), meaning no race conditions or special timing is required. No non-default configuration or special feature enablement is cited as a prerequisite - the missing authorization check affects standard platform operations across all instances running versions 2.2.3 through pre-2.3.1. Exploitation is bounded by the requirement to first obtain a low-privilege account; unauthenticated remote exploitation is not supported by the available CVSS vector (PR:L, not PR:N). |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals high real-world risk: network-reachable, low complexity, no user interaction required, and full confidentiality, integrity, and availability impact upon successful escalation. The PR:L requirement means an attacker must first hold a valid low-privilege account, which is the primary limiting factor. No EPSS data was provided; KEV status is negative, and no public POC has been identified at time of analysis, meaning opportunistic mass exploitation is unlikely at present. However, given that Liman MYS is a server management platform with inherent access to underlying OS resources, a successful privilege escalation translates directly to full platform and potentially host-level compromise. The scope is bounded (S:U), limiting lateral blast radius, but the C:H/I:H/A:H triad on a management platform represents a critical business risk for affected operators. This is a genuine priority patch - not a high-CVSS-but-low-real-risk issue. |
| Exploit ScenarioDerived | An attacker holding a standard low-privilege Liman MYS account sends crafted HTTP requests directly to administrative endpoints that lack proper authorization enforcement. The server, failing to validate the caller's role, processes the request and grants elevated privileges or executes administrative operations on behalf of the low-privilege user. No public POC has been identified at time of analysis, but the low attack complexity (AC:L) suggests that exploiting this class of flaw requires minimal technical sophistication once an account is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 04, 2026
Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.
RemediationAI
Upgrade Liman MYS to version 2.3.1 or later, which contains the vendor-released patch addressing the missing authorization flaw. The TR-CERT advisory is available at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0741 and should be consulted for vendor-specific upgrade instructions. If immediate patching is not feasible, restrict network access to the Liman MYS management interface to only trusted internal network segments or VPN-controlled IP ranges, reducing the pool of users who can reach the vulnerable endpoints - note this does not eliminate risk from insider threats or compromised low-privilege accounts. Audit all existing user accounts for unauthorized privilege assignments that may indicate exploitation has already occurred. Disable or suspend unused low-privilege accounts until the patch can be applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Liman MYS is a centralized server management and monitoring platform developed by HAVELSAN Inc., a Turkish defense and IT company. The affected CPE is cpe:2.3:a:havelsan_inc.:liman_mys:*:*:*:*:*:*:*:* across versions 2.2.3 to pre-2.3.1. The root cause is CWE-862 (Missing Authorization): the application executes privileged administrative operations without first verifying that the requesting user possesses the necessary permissions. This is a server-side access control failure at the application layer - the system authenticates users but does not enforce role boundaries on sensitive endpoints, allowing any authenticated session to invoke administrator functionality.
Know when Liman Mys gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable missing authorization flaw requiring only a low-privilege account; full C/I/A impact reflects administrator-level takeover of a server management platform.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation.
This issue affects Liman MYS: from 2.2.3 before 2.3.1.
Executive ViewAI
Administrators of Liman MYS risk complete platform takeover by standard users due to CVE-2026-18650, a privilege escalation flaw in versions 2.2.3 through pre-2.3.1. This directly threatens operational control of Linux infrastructure for organizations, particularly in government and enterprise sectors, where this centralized management system is critical to business continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Missing authorization controls in HAVELSAN Liman MYS (versions 2.2.3 through before 2.3.1) allow a low-privileged authen
Privilege escalation and unauthorized functionality access in HAVELSAN Liman MYS (Yönetim Sistemi) before release.Master
HAVELSAN Liman MYS releases from 2.3.4-1124 up to but not including 2.3.5-1131 contain a weak forgotten-password recover
Path traversal in HAVELSAN Liman MYS before 2.3.5-1132 allows an authenticated low-privilege user to read files outside
A path traversal flaw (CWE-22) in HAVELSAN Liman MYS versions 2.3.2 up to but not including 2.3.4-1124 allows remote, un
Exploit-DB